1. OVERVIEW The Maxthon Browser application is vulnerable to Insecure DLL Hijacking Vulnerability. Similar terms that describe this vulnerability have been come up with Remote Binary Planting, and Insecure DLL Loading/Injection/Hijacking/Preloading. 2. PRODUCT DESCRIPTION Maxthon Browser is a powerful tabbed browser built for all users. Besides basic browsing functionality, it provides a rich set of features (http://www.maxthon.com/overview.htm) to improve web surfing experience. it has got over 400,000K+ downloads and one of the famous browsers. 3. VULNERABILITY DESCRIPTION The Maxthon Browser application passes an insufficiently qualified path in loading an external library, "dwmapi.dll" when a user opens its associated file with extensions - htm, html, mhtml. 4. VERSIONS AFFECTED 2.5.15.1000 and lower version family of 2.x.x.x 5. PROOF-OF-CONCEPT/EXPLOIT http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/maxthon/poc/movie/ http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/maxthon/poc/maxthon.exe_2.5.15.1000_dwmapi.dll.zip 6. IMPACT Attackers can trigger a successful exploit against a victim user through a number of ways such as placing a malicious external library file together with an interesting file in network shares, distributing it via usb drives, embedding it in archive files that are released through file sharing networks. 7. SOLUTION Fixed version from the vendor has not been released yet. However, it is suggested that the following workarounds be deployed by users to protect increasing mass exploitation of this vulnerability class: - Disable loading of libraries from WebDAV and remote network shares - Disable the WebClient service Please see workaround solution links in References section. 8. VENDOR Maxthon International Limited http://www.maxthon.com/ 9. CREDIT This vulnerability was discovered by Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar. 10. DISCLOSURE TIME-LINE 08-28-2010: vulnerability discovered 08-28-2010: notified vendor 08-28-2010: vulnerability disclosed 11. REFERENCES Original Advisory URL: http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/[maxthon]_2.5.15.1000_insecure_dll_hijacking_(dwmapi.dll) Workaround Solution: http://support.microsoft.com/kb/2264107 Workaround Solution: https://www.microsoft.com/technet/security/advisory/2269637.mspx#EGF Unofficial DLL Hijacking List: http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/ #yehg [08-28-2010] --------------------------------- Best regards, YGN Ethical Hacker Group Yangon, Myanmar http://yehg.net Our Lab | http://yehg.net/lab Our Directory | http://yehg.net/hwd
