Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: Photodex ProShow Producer Vendor URL: www.photodex.com Type: Uncontrolled Search Path Element [CWE-427] Date found: 2013-02-23 Date published: 2013-02-23 CVSSv2 Score: 4,4 (AV:L/AC:M/Au:N/C:P/I:P/A:P) CVE: - 2. CREDITS ---------- This vulnerability was discovered and researched by Julien Ahrens from Inshell Security. 3. VERSIONS AFFECTED -------------------- Photodex ProShow Producer v5.0.3297, older versions may be affected too. 4. VULNERABILITY DESCRIPTION ---------------------------- An insecure library loading vulnerability has been identified in Photodex ProShow Producer v5.0.3297. The application uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of a library in the application path, the program will load it before the legitimate version. This allows an attacker to inject custom code that will be run with the privilege of the program or user executing the program. The following libraries could be hijacked on this way: d3d9.dll dbghelp.dll dciman32.dll ddraw.dll midimap.dll mscms.dll ws2help.dll 5. PROOF-OF-CONCEPT (CODE / Exploit) ------------------------------------ // wine gcc -Wall -shared inject.c -o ddraw.dll #include <windows.h> BOOL WINAPI DllMain(HINSTANCE hInstDLL, DWORD dwReason, LPVOID lpvReserved) { if (dwReason == DLL_PROCESS_ATTACH) { MessageBox(0,"DLL Injection","DLL Injection", 0); } return TRUE; } For further Screenshots and/or PoCs visit: http://security.inshell.net/advisory/48 6. SOLUTION ----------- None 7. REPORT TIMELINE ------------------ 2013-02-23: Discovery of the vulnerability 2013-02-23: Full Disclosure because the vendor ignored previous reports. 8. REFERENCES ------------- http://security.inshell.net/advisory/48
