{"id":3883,"date":"2013-07-05T07:00:00","date_gmt":"2013-07-05T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2013\/07\/05\/it-rather-involved-being-on-the-other-side-of-this-airtight-hatchway-disabling-safe-dll-searching\/"},"modified":"2013-07-05T07:00:00","modified_gmt":"2013-07-05T07:00:00","slug":"it-rather-involved-being-on-the-other-side-of-this-airtight-hatchway-disabling-safe-dll-searching","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20130705-00\/?p=3883","title":{"rendered":"It rather involved being on the other side of this airtight hatchway: Disabling Safe DLL searching"},"content":{"rendered":"

\nThe\n\nMicrosoft Vulnerability Research<\/a>\nteam discovered a potential\n\ncurrent directory attack<\/a>\nin a third party program.\nThe vendor, however, turned around and forwarded the report\nto the\n\nMicrosoft Security Response Center<\/a>:\n<\/p>\n

\n

\nOur investigation suggests that this issue is due to a bug\nin Microsoft system DLLs rather than our program.\nWhen a process is launched,\nfor example, when the user double-clicks the icon in Explorer,\na new process object is created, and the DLLs are loaded\nby a component known as the Loader.\nThe Loader locates the DLLs,\nmaps them into memory,\nand then calls the DllMain function for each of the modules.\nIt appears that some Microsoft DLLs obtain DLLs from the\ncurrent directory and are therefore susceptible to a current\ndirectory attack.\nWe created a simple Win32 application which demonstrates the issue:\n<\/p>\n

\n#include <windows.h>\nint __cdecl main(int argc, char **argv)\n{\n return MessageBox(NULL, \"Test\", \"Test\", MB_OK);\n}\n<\/pre>\n
\nIf you place a fake copy of DWMAPI.DLL<\/code>\nin the same directory as the application,\nthen the Loader will use that fake copy instead of the system one.\n<\/p>\n
\nThis technique can be used to attack many popular programs.\nFor example, placing a fake copy of\nDWMAPI.DLL<\/code> in the\nC:\\Program Files\\Internet Explorer<\/code> directory\nallows it to be injected into Internet Explorer.\nPlacing the file in the\nC:\\Program Files\\Adobe\\Reader 9.0\\Reader<\/code> directory\nallows it to be injected into Adobe Reader.\n<\/p>\n<\/blockquote>\n
\n(I like how the report\n\nbegins with some exposition<\/a>.)\n<\/p>\n
\nThe vendor appears to have confused two directories,\nthe current directory and the application directory.\nThey start out talking about a current directory attack,\nbut when the money sentence arrives,\nthey talk about placing the rogue DLL\n“in the same directory as the application,”\nwhich makes this not a current directory attack\nbut an application directory attack.\n<\/p>\n
\nWe saw some time ago that\n\nthe directory is the application bundle<\/a>,\nand the application bundle can override DLLs in the system directory.\nAgain, this is just another illustration of the importance of\n\nsecuring your application directory<\/a>.\n<\/p>\n
\nThe specific attacks listed at the end of the report\nrequire writing into\nC:\\Program Files<\/code>,\nbut in order to drop your rogue DWMAPI.DLL<\/code> file\ninto that directory,\nyou need to have administrative privileges in the first place.\n<\/p>\n
\nIn other words, in order to attack the system,\nyou first need to get on the other side of the airtight hatchway.\n<\/p>\n
\nThere was one final attempt to salvage this bogus vulnerability report:\n<\/p>\n
\n
\nWe can also reproduce the problem without requiring write access\nto the Program Files<\/code> directory\nby disabling\n\nSafe DLL searching<\/a>.\n<\/p>\n<\/blockquote>\n
\nNice try.\nIn order to disable Safe DLL searching,\nyou need to have administrator privileges,\nso you’re already on the other side of the airtight hatchway.\nAnd if you elevate to administrator\nand disable safe DLL searching,\nthen is it any surprise that you have unsafe DLL searching?\nThis is just another case of\n\nIf you set up an insecure system, don’t be surprised that there’s\na security vulnerability<\/i><\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Microsoft Vulnerability Research team discovered a potential current directory attack in a third party program. The vendor, however, turned around and forwarded the report to the Microsoft Security Response Center: Our investigation suggests that this issue is due to a bug in Microsoft system DLLs rather than our program. When a process is launched, […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-3883","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"
The Microsoft Vulnerability Research team discovered a potential current directory attack in a third party program. The vendor, however, turned around and forwarded the report to the Microsoft Security Response Center: Our investigation suggests that this issue is due to a bug in Microsoft system DLLs rather than our program. When a process is launched, […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/3883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=3883"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/3883\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=3883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=3883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=3883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}