Windows DLL bug hits dozens of apps

[Borg 386]

A flaw in the way Windows handles DLL (dynamic-link library) and related files likely affects hundreds of applications and has already been used in malicious attacks in the wild, a security researcher said on Tuesday.

Microsoft acknowledged in an advisory on Monday a type of attack mechanism known as DLL preloading, or binary planting and said that while it is not new it does have a new remote-attack vector. Malicious code can now be planted on a network share instead of just on a local system, making it much easier to attack vulnerable systems by duping people into clicking on malicious Web links or opening malicious documents.

Now, the Exploit-db.com exploit database is getting flooded with submissions of applications that people say are vulnerable, including Windows Live Mail, Windows Movie Maker, Microsoft PowerPoint 2010, Office 2007, and non-Microsoft applications like Firefox 3.6.8, Foxit Reader, Wireshark and uTorrent, said Mati Aharoni, founder of security firm Offensive Security, which runs the exploit database.

Read More:

Windows DLL bug hits dozens of apps | Security - CNET News

 

[Jacee]

See the 'work-around' Microsoft Offers Workaround For Remote DLL Vulnerability

 

[DirtRider]

Don't you just love this consistent race to keep ahead

 

[fseal]

At this point this is more like the race of the "researchers" trying to keep their names ahead of other researchers.

I've got a serious security announcement. Windows is insecure because users are allowed to install programs. Programs that may contain trojans. In fact ALL OSes (that are not admin locked down tight) are compeltely vunerable to this attack.

I suggest that all OS vendors now adopt a policy of not allowing any prgram or plugin installs after OS install to close this hole.

(There is significantly zero difference between "somehow" replacing a DLL in a program folder and replacing the exe itself or installing a new exe containing the exact same malicious payloads)

 

[Borg 386]

Thanx Jacee

One of the links leads to an MS site that offers a tool

Another option for protecting your systems is to deploy a tool that can help prevent exploitation of this issue. Knowledge Base article 2264107 offers for download a tool that allows customers to selectively change the library loading behavior, either system-wide or for specific applications.

A new CWDIllegalInDllSearch registry entry is available to control the DLL search path algorithm

 

[fseal]

Someone needs to be the guinea pig and test this on a test machine. From reading the article, there is a good chance that installing it may break nearly every single installed program on your machine since nearly every single installed program (of any heft) runs with DLLs in it's CWD and all programs default to allowing the OS to "search" for them rather than load them by hand.

The number of programs that work and how deeply they work till they break could vary greatly.

 

[Borg 386]

Someone needs to be the guinea pig and test this on a test machine. From reading the article, there is a good chance that installing it may break nearly every single installed program on your machine since nearly every single installed program (of any heft) runs with DLLs in it's CWD and all programs default to allowing the OS to "search" for them rather than load them by hand.

The number of programs that work and how deeply they work till they break could vary greatly.

Yeah I was kinda wondering about that after I saw what it involved

The patch breaks Chrome. When opening Chrome, it says it cannot find the file avutil-50.dll .

It appears the MS Tool does not actually add the CWDIllegalInDllSearch registry value, rather it just updates the .dll's outlined in A new CWDIllegalInDllSearch registry entry is available to control the DLL search path algorithm . Can someone verify this on their systems. I tested the update on XP SP3 and Win 7. Manual creation of the registry key seems to be needed.

Read More:

DLL hijacking vulnerabilities

 

[dranfu]

Excellent info. Thank you.

 

[Corrine]

Here's a list of actual potentially vulnerable applications: DLL Hijacking (KB 2269637) – the unofficial list (Peter Van Eeckhoutte).

In the event a program is "broken" by the Microsoft tool, if you use WinPatrol PLUS, with this simple entry, WinPatrol will notify you if anyone tries to create and change the value.

The steps are simple. Start by launching WinPatrol, select the "Registry Monitoring" tab and click Add. A new window will open to add the item to be monitored.

• Registry Key: In the Registry Key selection drop-down, make sure HKEY_LOCAL_MACHINE is selected.
• Type or copy/paste the following in the space provided under Registry Key:

SYSTEM\CurrentControlSet\Control\Session Manager

• Name: In the Name space, type or copy/paste CWDIllegalInDllSearch
• Value: In the space for Value, type 1 (the number one).
• Value Type: In the drop-down box, select REG_DWORD
• Click the Add button.

If additional information is needed, illustrations are included in my blog post Protection From DLL Vulnerability with WinPatrol PLUS.

 

[Borg 386]

Thanx Corrine....

I hope MS fixes this soon...like I have any time for anything anymore.

Incredible...school just started and I'm already up to my *ss in homework.:sarc:

 

[Corrine]

There is the download in KB 2264107. Perhaps it will be rolled in to a SP. However, I am thinking that Microsoft may only be able to address Microsoft products because I gather the details may vary from application to application. Thus, I gather this is not just a Microsoft issue.

 

[Corrine]

Update on Security Advisory 2269673

(Cross-posting due to multiple topics on this issue.)

As described in the Security, Research & Defense blog (linked below), the following would need to occur in order to be exploited:

"this class of vulnerabilities could allow malicious code to run if an attacker can convince a victim to do the following:

• Browse to a malicious, untrusted WebDAV server in the Internet Zone; and
• Double-click a file that appears by its extension and icon to be safe"

Microsoft plans to address the Microsoft products affected by this issue, primarily be in the form of security updates or defense-in-depth updates. However, as to third-party products, it is up to those vendors to provide patches for their affected software, which may take some time or, as Jerry Bryant indicated, may not be possible. As a result, the Microsoft Fix it Team has developed a Fix it solution to enable the Microsoft-recommended setting which blocks most network-based vectors.

Microsoft Fix it 50522 Steps:

1. Download and then install update 2264107, available from the bottom of the page at KB 2264107.
2. From the same page, click the Fix it button or link under the Enable this fix it heading. Click Run in the File Download dialog box, and then follow the steps in the fix it wizard.
   
   The Fix it solution will deploy the registry entry that is needed to block nonsecure DLL loads from WebDAV and SMB locations.

Note: The tool is limited to protecting against DLL preloading only and does not protect against .exe files that do not properly load files via a fully qualified path. As stated previously, the software vendors will be required to update those applications accordingly.

• MSRC Blog: Update on Security Advisory 2269673
• SR&D Blog: An update on the DLL-preloading remote attack vector
• TechNet: Knowledge Base Article 2264107