Update on Security Advisory 2269673, Including Microsoft Fix it

Last week, Microsoft released Security Advisory 2269637 which relates to a remote attack vector to a class of vulnerabilities affecting applications that load DLL’s in an insecure manner.  As described in the Security, Research & Defense blog, the following would need to occur in order to be exploited: 

"this class of vulnerabilities could allow malicious code to run if an attacker can convince a victim to do the following:

• Browse to a malicious, untrusted WebDAV server in the Internet Zone; and
• Double-click a file that appears by its extension and icon to be safe"

Jerry Bryant explained at the MSRC Blog in Update on Security Advisory 2269673 that Microsoft plans to address the Microsoft products affected by this issue, primarily be in the form of security updates or defense-in-depth updates.

It is important to keep in mind that while Microsoft continues investigations in Microsoft products that are impacted by the vulnerability, there are many third-party applications that are also impacted (see DLL Hijacking (KB 2269637) – the unofficial list by Peter Van Eeckhoutte).  It is up to those vendors to provide patches for their affected software, which may take some time or, as Jerry Bryant indicated, may not be possible.  As a result, the Microsoft Fix it Team has developed a Fix it solution to enable the Microsoft-recommended setting which blocks most network-based vectors.

Microsoft Fix it 50522

Steps:

1. Download and then install update 2264107, available from the bottom of the page at KB 2264107.
2. From the same page, click the Fix it button or link under the Enable this fix it heading. Click Run in the File Download dialog box, and then follow the steps in the fix it wizard. 
   
   The Fix it solution will deploy the registry entry that is needed to block nonsecure DLL loads from WebDAV and SMB locations.

Note:  The tool is limited to protecting against DLL preloading only and does not protect against .exe files that do not properly load files via a fully qualified path.  As stated previously, the software vendors will be required to update those applications accordingly.


References:

• DLL Hijacking (KB 2269637) – the unofficial list (Peter Van Eeckhoutte)
• MSRC Blog:  Update on Security Advisory 2269673
• SR&D Blog:  An update on the DLL-preloading remote attack vector
• TechNet: Knowledge Base Article 2264107

Clubhouse Tags: Clubhouse, Microsoft, Windows, Security, Advisory, Vulnerabilities, Information, Fix it, How to,

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Protection From DLL Vulnerability with WinPatrol PLUS

The day after Microsoft released Security Advisory 2269637 (relating to a remote attack vector to a class of vulnerabilities affecting applications that load DLL’s in an insecure manner), the first exploits were released. These exploits were identified as targeting programs including Firefox, uTorrent BitTorrent client, and Microsoft PowerPoint. As reported by Peter Van Eeckhoutte in DLL Hijacking (KB 2269637) – the unofficial list, the list is much longer now and includes many well known applications.

The MSRC Blog reported that Microsoft conducting investigations into how this vector may affect Microsoft products. In addition, Microsoft released KB Article 2264107, which includes a new CWDIllegalInDllSearch registry entry to control the DLL search path algorithm:

"The update allows the administrator to define the following on a system-wide or a per-application basis:

• Remove the current working directory from the library search path.
• Prevent an application from loading a library from a WebDAV location.
• Prevent an application from loading a library from both a WebDAV, as well as a remote UNC location."

That may be fine for IT Professionals, but what about home computer users? If, like me, you use WinPatrol PLUS, you have at your fingertips a simple method of adding protection from the DLL (CWDIllegalInDllSearch) vulnerability. Bill Pytlovany added the entries to include in WinPatrol Registry Monitoring Scripts . With this simple entry, WinPatrol will notify you if anyone tries to create and change this value from a non-zero value.

Edit Note: The instructions have been updated to change the following question by ky331 and response by Bill Pytlovany after his discussions with some folks at Microsoft. (See the Comments below.)

The steps are simple. Start by launching WinPatrol, select the "Registry Monitoring" tab and click Add:


As illustrated in the simple steps below, a new window will open to add the item to be monitored.

Registry Key: In the Registry Key selection drop-down, make sure HKEY_LOCAL_MACHINE is selected.

Type or copy/paste the following in the space provided under Registry Key:
SYSTEM\CurrentControlSet\Control\Session Manager

Name: In the Name space, type or copy/paste CWDIllegalInDllSearch

Value: In the space for Value, type 1 (the number one).

Value Type: In the drop-down box, select REG_DWORD

Click the Add button.

The results:


It is that simple with WinPatrol PLUS! Unemployed and unable to afford a license? Be sure to check out WinPatrol Supports Unemployed Job Seekers.




References:

• BillP Studios: WinPatrol Registry Monitoring Scripts
• DLL Hijacking (KB 2269637) – the unofficial list (Peter Van Eeckhoutte)
  
• KB 2264107: A new CWDIllegalInDllSearch registry entry is available to control the DLL search path algorithm
  
• ISC SANS: DLL hijacking vulnerabilities
• Firefox, uTorrent, and PowerPoint hit by Windows DLL bug
• Knowledge Base article 2264107
• MSRC Blog: Microsoft Security Advisory 2269637 Released
• SR&D Blog: More information about the DLL Preloading remote attack vector
• TechNet: Security Advisory 2269637

Clubhouse Tags: Clubhouse, Microsoft, Windows, Security, WinPatrol, Information, Advisory, Vulnerabilities, How-to, WinPatrol,

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft Security Advisory 2269637 Released

Microsoft released Security Advisory 2269637 which relates to a remote attack vector to a class of vulnerabilities affecting applications that load DLL’s in an insecure manner.

Microsoft is conducting investigations into how this vector may affect Microsoft products. In the meantime, both the Security Advisory and the SR&D blog have information for IT Pros as well as a tool that can be configured to disable the loading of libraries from network shares. See Knowledge Base article 2264107.

Although the above addresses networks, what danger is there to home computer users? The people most likely to be impacted are those who use P2P file-sharing programs such as uTorrent. The Mitigating Factors in the Security Advisory are pertinent in this regard.

This issue only affects applications that do not load external libraries securely.

For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application.

P2P programs form a direct conduit on to your computer. They have always been a target of malware writers. P2P security measures are easily circumvented and if your P2P program is not configured correctly, you may be sharing more files than you realize. There have been cases where people's passwords, address books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program.

With P2P file sharing, what means do you have of identifying or authenticating the source of the download? In addition, a file can be distributed among many hosts, and peers will provide for download the sections that they have already downloaded. This results in the distinct possibility of a distribution method in which malicious bits are mixed with with good files.

Computers are expensive. Protect your investment. Only download programs from reputable websites and do not use P2P file-sharing software programs.


References:

• Knowledge Base article 2264107
• MSRC Blog: Microsoft Security Advisory 2269637 Released
• SR&D Blog: More information about the DLL Preloading remote attack vector
• TechNet: Security Advisory 2269637

Clubhouse Tags: Clubhouse, Microsoft, Windows, Security, Advisory, Vulnerabilities, Information,

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...