Having reviewed the git commit for 1.1.1 I notice the following issue:
The environment variables that usually point to the secure administrator
directories (such as "Program Files") are not themselves secured, and not
intended as a secure means of obtaining these directory locations, which
are (by definition) subject to change via system configuration (initial
or later!).
There are official system library calls to obtain the actual locations
as follows:
1. If looking for the location where a program is itself installed, use
the GetModuleFilenameW(own-hinstance) call to obtain the path to once
own DLL or EXE. This automatically adapts to wherever the DLL or EXE
is copied or moved. This is a kernel32.dll API and returns a location
with security very close to that of the binary itself.The name
returned is from the in-process instance of the dynamic linker.
2. If looking for the location where the running program's top level file
(such as openssl.exe or
some-program-loading-an-openssl-using-plugin.exe),
use that same call but pass NULL for the hinstance parameter.
3. If looking for the system-wide secured "/etc" directory, use the
GetSystemDirectoryW() call and append the fixed string "\\Drivers\\etc" .
This location is permanently restricted to the system administrators and
already contains a few traditional unix files such as "hosts". This too
is a kernel32.dll API. The name returned is from a system internal value
set during OS boot.
4. If looking for the directory intended to hold system-wide configuration
and data files, use the SHGetFolderPathW(CSIDL_COMMON_APPDATA) API from
shfolder.dll or shell32.dll (fallback) to ask for the "all-users data
directory", append a company/project name (such as "\\OpenSSL") and
specify an appropriate ACL in the security argument to CreateDirectoryW()
(if the directory doesn't already exist with a user-modified ACL,
CreateDirectoryW will atomically detect this and return a specific error
code in the per thread GetLastError() variable).Note that mkdir()
only creates one level of directories per invocation and you may want
different ACLs when creating missing parent directories. The values
returned by SHGetFolderPathW() are typically from one or more
Administrator
controlled registry keys.
Some of the above APIs may require their return value to be canonicalized
via the GetFullPathNameW() API in corner cases, retaining the result in
a global variable is advisable.
On 30/07/2019 16:27, OpenSSL wrote:
OpenSSL Security Advisory [30 July 2019]
========================================
Windows builds with insecure path defaults (CVE-2019-1552)
==========================================================
Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
