Updated: Microsoft Security Advisory (2269637)

ronjor · Aug 23, 2010

Insecure Library Loading Could Allow Remote Code Execution
Published: August 23, 2010

Version: 1.0
General Information
Executive Summary

Microsoft is aware that research has been published detailing a remote attack vector for a class of vulnerabilities that affects how applications load external libraries.

This issue is caused by specific insecure programming practices that allow so-called "binary planting" or "DLL preloading attacks". These practices could allow an attacker to remotely execute arbitrary code in the context of the user running the vulnerable application when the user opens a file from an untrusted location.

This issue is caused by applications passing an insufficiently qualified path when loading an external library. Microsoft has issued guidance to developers in the MSDN article, Dynamic-Link Library Security, on how to correctly use the available application programming interfaces to prevent this class of vulnerability. Microsoft is also actively reaching out to third-party vendors through the Microsoft Vulnerability Research Program to inform them of the mitigations available in the operating system. Microsoft is also actively investigating which of its own applications may be affected.

In addition to this guidance, Microsoft is releasing a tool that allows system administrators to mitigate the risk of this new attack vector by altering the library loading behavior system-wide or for specific applications. This advisory describes the functionality of this tool and other actions that customers can take to help protect their systems.

Mitigating Factors:
•

This issue only affects applications that do not load external libraries securely. Microsoft has previously published guidelines for developers in the MSDN article, Dynamic-Link Library Security, that recommend alternate methods to load libraries that are safe against these attacks.
•

For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application.
•

The file sharing protocol SMB is often disabled on the perimeter firewall. This limits the possible attack vectors for this vulnerability.
Click to expand...

https://www.microsoft.com/technet/security/advisory/2269637.mspx

MrBrian · Aug 23, 2010

Re: Microsoft Security Advisory (2269637)

Related thread: https://www.wilderssecurity.com/showthread.php?t=280005

ronjor · Aug 31, 2010

Re: Microsoft Security Advisory (2269637)

Update on Security Advisory 2269673

Hi everyone,

Since we released Security Advisory 2269673 on August 23, we've continued to conduct an investigation not only into our own affected products, but also into how we can best help to protect customers given DLL preloading also affects some third-party applications. We'd like to provide an update on our investigation.

First, I want to be clear that Microsoft plans to address those of our products affected by this issue in the most appropriate way for customers. This will primarily be in the form of security updates or defense-in-depth updates. Also, due to the fact that customers need to click through a series of warnings and dialogs to open a malicious file, we rate most of these vulnerabilities as important.
Click to expand...

http://blogs.technet.com/b/msrc/archive/2010/08/31/update-on-security-advisory-2269673.aspx

ronjor · Aug 31, 2010

Re: Microsoft Security Advisory (2269637)

Microsoft Security Advisory (2269637)
Insecure Library Loading Could Allow Remote Code Execution
Published: August 23, 2010 | Updated: August 31, 2010
Click to expand...

V1.1 (August 31, 2010) Added a link to Microsoft Knowledge Base Article 2264107 to provide an automated Microsoft Fix it solution for the workaround, Disable loading of libraries from WebDAV and remote network shares.
Click to expand...

https://www.microsoft.com/technet/security/advisory/2269637.mspx

wearetheborg · Sep 1, 2010

Re: Microsoft Security Advisory (2269637)

ronjor said:

https://www.microsoft.com/technet/security/advisory/2269637.mspx
Click to expand...

What is WebDAV?

Rilla927 · Sep 1, 2010

Re: Microsoft Security Advisory (2269637)

Here ya go http://www.google.com/search?q=WebDAV&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-USfficial&client=firefox-a

Log in or Sign up

Updated: Microsoft Security Advisory (2269637)

ronjor Global Moderator

MrBrian Registered Member

ronjor Global Moderator

ronjor Global Moderator

wearetheborg Registered Member

Rilla927 Registered Member

Log in or Sign up

Updated: Microsoft Security Advisory (2269637)

ronjor Global Moderator

MrBrian Registered Member

ronjor Global Moderator

ronjor Global Moderator

wearetheborg Registered Member

Rilla927 Registered Member

Useful Searches