21–30 of 52 posts
Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.
Doesn't sound too difficult if you're sending someone an archive with both files in it.
Earlier quoted context omitted.
I wonder if Notepad, Wordpad, and maybe Word all call some library (or all have copy/pasted code) that, for whatever reason, looks for a particular DLL in the working folder and executes it? Not sure how the network drive part would fit into that hypothesis, though.
The article doesn't mention it, but does anyone know if a requirement to reproduce the vulnerability is that the files be opened in Notepad, Wordpad, or Word? What if you used a third-party editor?
(As was commented on below, this is identical to an LD_LIBRARY_PATH type exploit on Linux; here is Microsoft's fix as well as an explanation of how it works http://support.microsoft.com/kb/2264107)
Edit: I realize now literally any URL could be a WebDAV site with a text/plain mime type and an exploit DLL in the same dir. So really, every single URL you hit with IE is potentially vulnerable. Have a nice day.
So basically send someone a zip file with a DLL + readme.txt. Most people would avoid the DLL but not think twice about opening the readme. Sounds nasty.
From the "Mitigating Factors" section of CVE-2011-1991: "For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application." Since a ZIP file would extract to a local directory, nothing would happen.
All the stuff about WebDav being necessary for a successful attack is because they're assuming someone can't drop a DLL onto your system. But if you unzip a package with a README.txt in the same folder as a DLL you would be vulnerable.
Earlier quoted context omitted.
> this looks like it would be difficult to execute since the text file has to be in the same directory as the dll. Seems like a great way to compromise your boss' computer since so many businesses use Windows and networked file systems.
Unless you have an exceptionally paranoid workplace, a much easier way to compromise your boss's computer is just to walk over to it and pop in a livecd after he's gone home for the day.
Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.
https://community.rapid7.com/community/infosec/blog/2010/08/...
http://blogs.msdn.com/b/david_leblanc/archive/2008/02/20/dll...
http://www.n00bz.net/blog/2010/9/15/dll-hijacking-with-metas...
Earlier quoted context omitted.
The article doesn't mention it, but does anyone know if a requirement to reproduce the vulnerability is that the files be opened in Notepad, Wordpad, or Word? What if you used a third-party editor?
I'm guessing it's actually a bug with Explorer (that is, the actual opening action) than any particular editor, since RTF files are also affected - and doubtlessly many other file types.