Symantec informed customers on Tuesday that it has addressed a DLL loading flaw in several of its enterprise products. These types of vulnerabilities affect software from many major vendors, but they are often seen as low risk issues.
The DLL hijacking flaw, tracked as CVE-2016-6590, was brought to Symantec’s attention by one of its employees, senior threat analysis engineer Himanshu Mehta. The security hole affects Symantec’s IT Management Suite (ITMS) 8.0, Ghost Solution Suite (GSS) 3.1 and Endpoint Virtualization (SEV) 7.x. Updates have been released for each of the vulnerable products.
According to Symantec, the affected products don’t use an absolute path when loading DLL files during boot-up or reboot. This can lead to a rogue DLL file being loaded by the software before the legitimate file, resulting in arbitrary code execution, possibly even with elevated privileges.
For the attack to work, the attacker must be able to plant a malicious file or trick the victim into downloading the rogue DLL to their system.
In Windows, applications can control the location from which a DLL is loaded by specifying a full path or by using other mechanisms. However, if these methods are not used, the operating system relies on a standard DLL search order to locate the needed file.
In the case of desktop applications, the OS first looks for the DLL in the directory from which the app is loaded. As several researchers warned in the past months, this can pose a serious risk in the case of installers, which are typically executed from the “Downloads” folder. Since files downloaded from the Internet are usually saved to this directory, it can be easy for attackers to get their malicious DLLs executed.
While Symantec has classified the DLL loading issue affecting its products as “high severity”, many organizations, including security firms, see these as low-risk flaws.
Mehta reported similar bugs to nine other software vendors this year, but not all of them addressed the problem.
Researcher Stefan Kanthak has disclosed DLL hijacking vulnerabilities affecting the installers of roughly 40 applications. Companies such as Oracle, Kaspersky Lab, Rapid7, F-Secure and Comodo patched the flaws after being notified.
However, according to the advisories published by the expert, Microsoft, Google, Malwarebytes, Panda Security, ESET and many others either ignored him or said they did not believe this is an issue that needs fixing.
Related: VMware Tools Flaw Allowed Code Execution via DLL Hijacking
Related: Schneider Electric Patches DLL Hijacking Bug in Wonderware Products
Related: DLL Hijacking Flaws Found in Rockwell Automation’s FactoryTalk