1. OVERVIEW The Notepad++ application is vulnerable to Insecure DLL Hijacking Vulnerability. Similar terms that describe this vulnerability have been come up with Remote Binary Planting, and Insecure DLL Loading/Injection/Hijacking/Preloading. 2. PRODUCT DESCRIPTION Based on the powerful editing component Scintilla, Notepad++ is the most powerful and famous open-source text editor written in C++ and uses pure Win32 API and STL which ensures a higher execution speed and smaller program size. By optimizing as many routines as possible without losing user friendliness, Notepad++ is trying to reduce the world carbon dioxide emissions. When using less CPU power, the PC can throttle down and reduce power consumption, resulting in a greener environment. 3. VULNERABILITY DESCRIPTION The Notepad++ application passes an insufficiently qualified path in loading an external library, "scilexer.dll" when a user opens its associated file with extensions - css, inc, inf, ini, log, scp, wtx, shtml . This vulnerability depends on the following situations - - Notepad++ must have been made as the default text editor (so called users' most favorite "Notepad" replacement) - Affected extensions must not have been registered with other applications 4. VERSIONS AFFECTED 5.7 and lower 5. PROOF-OF-CONCEPT/EXPLOIT http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/notepad++/poc/movie http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/notepad++/poc/notepad++.exe_shtml_scilexer.dll.zip 6. IMPACT Attackers can trigger a successful exploit against a victim user through a number of ways such as placing a malicious external library file together with an interesting file in network shares, embedding it in archive files that are released through file sharing networks. 7. SOLUTION Fixed version from the vendor has not been released yet. However, it is suggested that the following workarounds be deployed by users to protect increasing mass exploitation of this vulnerability class: - Disable loading of libraries from WebDAV and remote network shares - Disable the WebClient service Please see workaround solution links in References section. 8. VENDOR Notepad++ Developers Team http://notepad-plus-plus.org/ 9. CREDIT This vulnerability was discovered by Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar. 10. DISCLOSURE TIME-LINE 08-28-2010: vulnerability discovered 08-28-2010: notified vendor 08-28-2010: vulnerability disclosed 11. REFERENCES Original Advisory URL: http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/[notepad++]_5.7_insecure_dll_hijacking Workaround Solution: http://support.microsoft.com/kb/2264107 Workaround Solution: https://www.microsoft.com/technet/security/advisory/2269637.mspx#EGF Unofficial DLL Hijacking List: http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/ #yehg [08-28-2010] --------------------------------- Best regards, YGN Ethical Hacker Group Yangon, Myanmar http://yehg.net Our Lab | http://yehg.net/lab Our Directory | http://yehg.net/hwd
