A security vulnerability report arrived that went roughly like this:<\/p>\n
\nThe Xyz object can be used to execute arbitrary command lines.<\/p>\n
\n
LoadLibrary(L\"xyz.dll\");<\/code><\/li>\nGetProcAddress<\/code> forDllGetClassObject<\/code>.<\/li>\n- Call
DllGetClassObject<\/code> withCLSID_Xyz<\/code> andIID_IXyz<\/code>.<\/li>\n- From the resulting object, call
IXyz::Initialize<\/code>, and thenIXyz::Execute<\/code>.<\/li>\n<\/ul>\n<\/blockquote>\nSo far, we don’t have any statement of vulnerability. Sure, the Xyz object can be used to execute arbitrary command lines, but how is that a security vulnerability?<\/p>\n
We asked the finder some questions to clarify the nature of the alleged vulnerability.<\/p>\n
\nQ: What is the attack vector?<\/p>\n
A: The attack vector is a Trojan horse executable. The victim needs to double-click the executable, which triggers the exploit.<\/p>\n
Q: Is there elevation of privilege?<\/p>\n
A: Not at this time.<\/p>\n
Q: Is this remote code execution.<\/p>\n
A: Essentially, it is not. The exploit must be downloaded to the victim machine in order to proceed with the attack.<\/p>\n
Q: As a result of this exploit, what can the attacker do that they couldn’t do without this issue?<\/p>\n
A: I don’t know. I am not a professional attacker. The main attack technique is as described in the original report. I think I explained it like this.<\/p>\n<\/blockquote>\n