Security Experts:

Connect with us

Hi, what are you looking for?



Symantec Patches DLL Hijacking Flaw in Enterprise Products

Symantec informed customers on Tuesday that it has addressed a DLL loading flaw in several of its enterprise products. These types of vulnerabilities affect software from many major vendors, but they are often seen as low risk issues.

Symantec informed customers on Tuesday that it has addressed a DLL loading flaw in several of its enterprise products. These types of vulnerabilities affect software from many major vendors, but they are often seen as low risk issues.

The DLL hijacking flaw, tracked as CVE-2016-6590, was brought to Symantec’s attention by one of its employees, senior threat analysis engineer Himanshu Mehta. The security hole affects Symantec’s IT Management Suite (ITMS) 8.0, Ghost Solution Suite (GSS) 3.1 and Endpoint Virtualization (SEV) 7.x. Updates have been released for each of the vulnerable products.

According to Symantec, the affected products don’t use an absolute path when loading DLL files during boot-up or reboot. This can lead to a rogue DLL file being loaded by the software before the legitimate file, resulting in arbitrary code execution, possibly even with elevated privileges.

For the attack to work, the attacker must be able to plant a malicious file or trick the victim into downloading the rogue DLL to their system.

In Windows, applications can control the location from which a DLL is loaded by specifying a full path or by using other mechanisms. However, if these methods are not used, the operating system relies on a standard DLL search order to locate the needed file.

In the case of desktop applications, the OS first looks for the DLL in the directory from which the app is loaded. As several researchers warned in the past months, this can pose a serious risk in the case of installers, which are typically executed from the “Downloads” folder. Since files downloaded from the Internet are usually saved to this directory, it can be easy for attackers to get their malicious DLLs executed.

While Symantec has classified the DLL loading issue affecting its products as “high severity”, many organizations, including security firms, see these as low-risk flaws.

Mehta reported similar bugs to nine other software vendors this year, but not all of them addressed the problem.

Researcher Stefan Kanthak has disclosed DLL hijacking vulnerabilities affecting the installers of roughly 40 applications. Companies such as Oracle, Kaspersky Lab, Rapid7, F-Secure and Comodo patched the flaws after being notified.

However, according to the advisories published by the expert, Microsoft, Google, Malwarebytes, Panda Security, ESET and many others either ignored him or said they did not believe this is an issue that needs fixing.

Related: VMware Tools Flaw Allowed Code Execution via DLL Hijacking

Related: Schneider Electric Patches DLL Hijacking Bug in Wonderware Products

Related: DLL Hijacking Flaws Found in Rockwell Automation’s FactoryTalk

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.


GoAnywhere MFT users warned about a zero-day remote code injection exploit that can be targeted directly from the internet