Re: Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code execution and escalation of privilege

[Justin Ferguson <justin () asac co>]

I'd mostly argue this is a user problem given that many things you
probably shouldn't be running out of your downloads directory, which
is the crux of his base argument. That said, its not reasonable to
expect users to entirely grok the nuances of such things, and so the
easiest fix is probably for browsers to automatically place DLLs and
exes into different directories (plural) than other downloads; id est
the concept of "Downloads\Executables" and "Downloads\Libraries" would
effectively mitigate the issue for the vast majority of actual threat
instances.

The problem with calling this an OS issue is that it makes a lot of
sense for the application directory to contain the DLLs for the
application as opposed to a system directory or even a per-user
directory, although I have to admit that with the advances in
installation and uninstallation in Windows this is a topic that might
be worth revisiting. That said, the obvious fix of changing the DLL
search path order at present doesn't make a whole lot of sense and
would break an awful lot of applications in unreasonable ways.

Given that the browser created the problem-- the "drive-by download",
the download directory and the download of the 'vulnerable'
application, it seems the best placement to say this is actually a
browser issue, even if the technical aspects itself are not so much
delimited by the browser and there are other less applicable in most
cases attack surfaces.



On Wed, Dec 23, 2015 at 11:46 AM, NaxoneZ . <naxonez () gmail com> wrote:
> I think like Shawn, this is a SO problem:
>
> https://msdn.microsoft.com/es-es/library/windows/desktop/ff919712(v=vs.85).aspx
>
> Anyway the developers can mitigate this issue following the guidelines
> described in article.
>
> Regards.
>
> 2015-12-23 16:32 GMT+01:00 Shawn McMahon <syberghost () gmail com>:
>
> > On Wed, Dec 23, 2015 at 7:13 AM, Stefan Kanthak <stefan.kanthak () nexgo de>
> > wrote:
> >
> > > Hi @ll,
> > >
> > > F-Secure's online virus scanner F-SecureOnlineScanner.exe, available
> > > via <https://www.f-secure.com/en/web/home_global/online-scanner>,
> > > loads and executes several rogue/bogus DLLs (UXTheme.dll, HNetCfg.dll,
> > > RASAdHlp.dll, SetupAPI.dll, ClbCatQ.dll, XPSP2Res.dll, CryptNet.dll,
> > > OLEAcc.dll etc.) eventually found in the directory it is started from
> > > (the "application directory").
> >
> > How long are you going to keep whacking these moles before you admit that
> > this is an OS problem, not an apps problem, and that Microsoft needs to fix
> > it?
> >
> > Because the moles breed a lot faster than you can whack.
> >
> > _______________________________________________
> > Sent through the Full Disclosure mailing list
> > https://nmap.org/mailman/listinfo/fulldisclosure
> > Web Archives & RSS: http://seclists.org/fulldisclosure/
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/