Insecure Library Loading Vulnerabilities

Last Update Date: 28 Jan 2011 Release Date: 26 Aug 2010 4285 Views

RISK: Medium Risk

A remote attack vector for a class of vulnerabilities that affects how applications load external libraries has been identified in various applications, which could be exploited by attackers to remotely execute arbitrary code in the context of the user running the vulnerable application when the user opens a file from an untrusted location.

1. Due to specific insecure programming practices that allow so-called "binary planting" or "DLL preloading attacks".

2. Due to applications passing an insufficiently qualified path when loading an external library.

Note: There is no patch available for this vulnerability currently.

Impact

Remote Code Execution

System / Technologies affected

Applications that do not load external libraries securely.
- Adobe Dreamweaver
- Adobe Photoshop
- Microsoft Office Groove
- Microsoft Office PowerPoint
- Microsoft Windows Address Book
- Microsoft Windows Live Mail
- Mozilla Firefox
- Opera

Solutions

Workarounds

Disable loading of libraries from WebDAV and remote network shares
- This workaround requires installation of the tool described in Microsoft Knowledge Base Article 2264107.
Disable the WebClient service
Block TCP ports 139 and 445 at the firewall
For details, please refer to the information
http://www.microsoft.com/technet/security/advisory/2269637.mspx

Vulnerability Identifier

No CVE information is available

Insecure Library Loading Vulnerabilities

Impact

System / Technologies affected

Solutions

Vulnerability Identifier

Source

Related Link