Full Disclosure mailing list archives

Re: Executable installers are vulnerable^WEVIL (case 15):F-SecureOnlineScanner.exe allows arbitrary (remote) codeexecution and escalation of privilege

From: <lists () acrossecurity com>
Date: Wed, 30 Dec 2015 11:14:07 +0100

Hi Stefan and all,

See the "CWDIllegalInDllSearchPath" setting introduced with KB2264107
about 5 years ago, after ACROS finally got enough attention for the
vulnerability first published as CVE-2000-0854 (that was 15 years ago,
but the vulnerability is still present in ALL installation programs):
there were^Ware applications that relied^Wy on loading DLLs from the
CWD, so Microsoft CAN'T exclude CWD from the PATH.
Microsoft can only offer support to exclude the CWD from the DLL search
order: developers can call SetDllDirectory(""), administrators can add
the global setting "CWDIllegalInDllSearchPath" or add this setting for
individual programs.


While we finally did get CVE-2000-0854 the overdue attention, we apparently
didn't promote this enough:
http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html
(presented at Source Boston in 2012). So now you'll have to do it - good
luck :)

BTW, Stefan, soon you'll be able to create your own patches for these, and
many other bugs, with http://0patch.com. You're welcome.

Cheers,
Mitja

Mitja Kolsek, CEO / @mkolsek

ACROS, d.o.o.
Makedonska ulica 113, SI - 2000 Maribor, Slovenia
Tel +386.2.3000.280  Fax +386.2.3000.282
Web http://www.acrossecurity.com
Blg http://blog.acrossecurity.com
Twt @acrossecurity

ACROS Security: Finding Your Digital Vulnerabilities Before Others Do




_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Current thread:

Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code execution and escalation of privilege Stefan Kanthak (Dec 23)
- Re: Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code execution and escalation of privilege Shawn McMahon (Dec 23)
  - Re: Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code execution and escalation of privilege NaxoneZ . (Dec 23)
    - Re: Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code execution and escalation of privilege Justin Ferguson (Dec 23)
  - Re: Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code execution and escalation of privilege Stefan Kanthak (Dec 26)
    - Re: Executable installers are vulnerable^WEVIL (case 15):F-SecureOnlineScanner.exe allows arbitrary (remote) codeexecution and escalation of privilege lists (Dec 30)
    - Re: Executable installers are vulnerable^WEVIL (case 15):F-SecureOnlineScanner.exe allows arbitrary (remote) codeexecution and escalation of privilege Stefan Kanthak (Dec 31)