Re: Nmap NOT VULNERABLE to Windows DLL Hijacking Vulnerability

[paul.szabo () sydney edu au]

Fyodor <fyodor () insecure org> wrote:

> > nmap <= 5.21 is vulnerable to Windows DLL Hijacking Vulnerability.
>
> Nmap is not vulnerable.  DLL hijacking works because of an unfortunate
> interaction between apps which register Windows file extensions and
> the default Windows DLL search path used for those apps.  Nmap does
> not, and never has, registered any Windows file extensions.  So it
> isn't vulnerable to this issue.

The "easy demo" is with clicks, which needs registration of extensions.
The "real thing" is a DLL in the current directory. Unless you always
use "cd path/to/nmap; ./nmap" to start, you are vulnerable: most people
would set their %PATH% to include the right thing for easy nmap.

Cheers, Paul

Paul Szabo   psz () maths usyd edu au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/