Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Symantec Patches DLL Hijacking Flaw in Enterprise Products

Symantec informed customers on Tuesday that it has addressed a DLL loading flaw in several of its enterprise products. These types of vulnerabilities affect software from many major vendors, but they are often seen as low risk issues.

Symantec informed customers on Tuesday that it has addressed a DLL loading flaw in several of its enterprise products. These types of vulnerabilities affect software from many major vendors, but they are often seen as low risk issues.

The DLL hijacking flaw, tracked as CVE-2016-6590, was brought to Symantec’s attention by one of its employees, senior threat analysis engineer Himanshu Mehta. The security hole affects Symantec’s IT Management Suite (ITMS) 8.0, Ghost Solution Suite (GSS) 3.1 and Endpoint Virtualization (SEV) 7.x. Updates have been released for each of the vulnerable products.

According to Symantec, the affected products don’t use an absolute path when loading DLL files during boot-up or reboot. This can lead to a rogue DLL file being loaded by the software before the legitimate file, resulting in arbitrary code execution, possibly even with elevated privileges.

For the attack to work, the attacker must be able to plant a malicious file or trick the victim into downloading the rogue DLL to their system.

In Windows, applications can control the location from which a DLL is loaded by specifying a full path or by using other mechanisms. However, if these methods are not used, the operating system relies on a standard DLL search order to locate the needed file.

In the case of desktop applications, the OS first looks for the DLL in the directory from which the app is loaded. As several researchers warned in the past months, this can pose a serious risk in the case of installers, which are typically executed from the “Downloads” folder. Since files downloaded from the Internet are usually saved to this directory, it can be easy for attackers to get their malicious DLLs executed.

While Symantec has classified the DLL loading issue affecting its products as “high severity”, many organizations, including security firms, see these as low-risk flaws.

Mehta reported similar bugs to nine other software vendors this year, but not all of them addressed the problem.

Advertisement. Scroll to continue reading.

Researcher Stefan Kanthak has disclosed DLL hijacking vulnerabilities affecting the installers of roughly 40 applications. Companies such as Oracle, Kaspersky Lab, Rapid7, F-Secure and Comodo patched the flaws after being notified.

However, according to the advisories published by the expert, Microsoft, Google, Malwarebytes, Panda Security, ESET and many others either ignored him or said they did not believe this is an issue that needs fixing.

Related: VMware Tools Flaw Allowed Code Execution via DLL Hijacking

Related: Schneider Electric Patches DLL Hijacking Bug in Wonderware Products

Related: DLL Hijacking Flaws Found in Rockwell Automation’s FactoryTalk

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.