Symantec informed customers on Tuesday that it has addressed a DLL loading flaw in several of its enterprise products. These types of vulnerabilities affect software from many major vendors, but they are often seen as low risk issues.
The DLL hijacking flaw, tracked as CVE-2016-6590, was brought to Symantec’s attention by one of its employees, senior threat analysis engineer Himanshu Mehta. The security hole affects Symantec’s IT Management Suite (ITMS) 8.0, Ghost Solution Suite (GSS) 3.1 and Endpoint Virtualization (SEV) 7.x. Updates have been released for each of the vulnerable products.
According to Symantec, the affected products don’t use an absolute path when loading DLL files during boot-up or reboot. This can lead to a rogue DLL file being loaded by the software before the legitimate file, resulting in arbitrary code execution, possibly even with elevated privileges.
For the attack to work, the attacker must be able to plant a malicious file or trick the victim into downloading the rogue DLL to their system.
In Windows, applications can control the location from which a DLL is loaded by specifying a full path or by using other mechanisms. However, if these methods are not used, the operating system relies on a standard DLL search order to locate the needed file.
In the case of desktop applications, the OS first looks for the DLL in the directory from which the app is loaded. As several researchers warned in the past months, this can pose a serious risk in the case of installers, which are typically executed from the “Downloads” folder. Since files downloaded from the Internet are usually saved to this directory, it can be easy for attackers to get their malicious DLLs executed.
While Symantec has classified the DLL loading issue affecting its products as “high severity”, many organizations, including security firms, see these as low-risk flaws.
Mehta reported similar bugs to nine other software vendors this year, but not all of them addressed the problem.
Researcher Stefan Kanthak has disclosed DLL hijacking vulnerabilities affecting the installers of roughly 40 applications. Companies such as Oracle, Kaspersky Lab, Rapid7, F-Secure and Comodo patched the flaws after being notified.
However, according to the advisories published by the expert, Microsoft, Google, Malwarebytes, Panda Security, ESET and many others either ignored him or said they did not believe this is an issue that needs fixing.
Related: VMware Tools Flaw Allowed Code Execution via DLL Hijacking
Related: Schneider Electric Patches DLL Hijacking Bug in Wonderware Products
Related: DLL Hijacking Flaws Found in Rockwell Automation’s FactoryTalk
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- Intel Co-founder, Philanthropist Gordon Moore Dies at 94
- Google Leads $16 Million Investment in Dope.security
- US Charges 20-Year-Old Head of Hacker Site BreachForums
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
