Once again a sad story of poor software "engineering", missing QA and a TOTALLY unresponsive vendor. The current version 6.3 of Terratec's TV software HomeCinema <http://ftp.terratec.de/Receiver/TerraTec_HomeCinema/TerraTec_Home_Cinema_6.3.exe> from 2009-05-05 installs outdated and vulnerable .DLLs (the test system used is a fully patched german Windows XP SP3): 1. Version 1.2.2 of ZLIB1.DLL is installed as "%ProgramFiles%\TerraTec\TerraTec HomeCinema\zlib1.dll". Current since 2005-07-18 is version 1.2.3 of ZLIB1.DLL (see <http://zlib.org/>): | Version 1.2.3 eliminates potential security vulnerabilities in | zlib 1.2.1 and 1.2.2, so all users of those versions should | *upgrade* *immediately*. 2. Version 5.1.3102.2180 of Microsoft's GDIPLUS.DLL is installed as "%SystemRoot%\SYSTEM32\GDIPLUS.DLL". The current version of GDIPLUS.DLL for Windows XP SP3 is 5.1.3102.5512, which is already part of the system and installed into Windows' side-by-side cache under "%SystemRoot%\WinSxS\"! According the MSDN GDIPLUS.DLL MUST NOT be installed into "%SystemRoot%\SYSTEM32\", and DLLs distributed with Windows MUST NOT be redistributed by ISVs. In addition see the MSFT security bulletin MS08-052 <http://www.microsoft.com/technet/security/bulletin/MS08-052.mspx> as well as the MSFT knowledge base article 954593 <http://support.microsoft.com/kb/954593/en-us>. 3. The DLLs of the current version of the component MSXML4 SP2 are installed to "%SystemRoot%\SYSTEM32\". This component is but not installed from the redistributable package provided by Microsoft that ISVs have to use to meet the legal mumbo-jumbo, instead Terratec choose to repackage the DLLs into an NSIS installer, thus violating MSFTs redistribution policy. (Un)fortunately this NSIS installer is flawed and does not perform all the necessary steps needed for a clean installation of MSXML4 SP2, so Microsoft Update detects the MSXML4 SP2 installation as outdated/incomplete and fetches the current patch installer (<http://support.microsoft.com/kb/954430/en-us>, <http://www.microsoft.com/technet/security/bulletin/MS08-069.mspx>) to repair it. The best of all: MSXML4 is NOT referenced at all by the installed application CynergyDVR.EXE, which but uses XMLLITE.DLL (<http://support.microsoft.com/kb/915865/en-us>) instead. 4. A superfluous pthreadVC2.dll is installed as "%CommonProgramFiles%\TerraTec\Cyberlink\Decoder\pthreadVC2.dll" Stefan Kanthak PS: Tools like Secunia's PSI don't detect such outdated and vulnerable DLLs. Admin beware! TIMELINE: 2009-06-16 phone call with Terratec's hotline - they were unable to take any action, but requested to send report per mail 2009-06-17 sent mail to Terratec - no response 2009-06-30 resent mail to Terratec - again no response 2009-07-16 report published
