News

PowerPoint, Firefox, Other Apps at Risk From DLL Flaw

• By Michael Hardy
• 08/25/2010

A vulnerability that Microsoft confirmed just yesterday is already being exploited, and the software giant says it can't fix the problem with a simple update. Instead, Microsoft says each affected application, many of them not under Microsoft's control, will have to be patched individually.

If you use Mozilla's Firefox Web browser, Microsoft PowerPoint or a peer-to-peer file-sharing application called uTorrent, you may already be compromised, according to a report in the British news site The Register. Hackers posted code to use the vulnerability to a hacker database, including specific exploits for several individual applications.

More than 200 applications could be vulnerable, according to Mitja Kolsek, CEO of Acros Security, the company based in Slovenia that first warned Microsoft of the weakness months ago.

According to Microsoft, the hack involves a problem with poorly written applications that call Dynamic Link Library (.dll) files without specifying a complete path. The application looks into the local directory for the library, and, at that point, it can load malware (disguised as the library file) that could enable the attacker to gain the same Windows network privileges as the user. While the mode of attack is old and well-known -- it's called .dll preloading, or binary planting -- the new wrinkle is that now attackers can launch it from remote servers.

So how big a deal is it? According to a report in CNET, Windows Live Mail, Windows Movie Maker, Microsoft PowerPoint 2010, Office 2007, Firefox 3.6.8, Foxit Reader, Wireshark and uTorrent, are among the applications users have reported as vulnerable to the Offensive Security's Exploit.db database, said Mati Aharoni, founder of the security firm Offensive Security.

"Today we broke a record in the Exploit-db with the amount of exploits for various Windows applications submitted in one day...all based on the same vulnerability," Aharoni said in CNET. "Right now it's in the dozens," he said, but he expects there will be hundreds of vulnerable applications reported before too long.

For attackers to make use of the weakness, users have to play along, said Jerry Bryant, group manager for response communication at Microsoft, quoted in CNET.

"DLL planting requires significant user interaction and cannot be exploited by simply browsing to a Web page," Bryant said. "An attacker would have to convince a user to click a link to their SMB (Server Message Block) or WebDAV (Web-based Distributed Authoring and Versioning) share and then convince the user to open a file from that share which would trigger additional dialogs prompting the user to OK the action."

Adrian Kingsley-Hughes, writing in ZDNet, offered similar advice:

"Hundreds of applications being vulnerable and needing to be [patched are] going to be a major headache for end users," he wrote. "Not only with the patch and update load increase, but then there’s the added problem of [applications] that are no longer being supported never seeing updates. My advice is that you should take care. Be especially wary of unsolicited links and documents sent to you by e-mail or other communication channels."