Insecure Library Loading in OS and Applications

While reading Microsoft’s confirmation of the DLL preloading risks in arbitrary Windows applications vulnerability, somehow it reminded me of the wave of LD_PRELOAD vulnerabilities that were exploited many years back on multiple non-Windows-based systems. It’s not a new class of vulnerability; the recent LNK file zero-day was probably the last biggest flaw that allows untrusted components to be loaded using a legitimate technique designed into the system.

I had the privilege to speak with a few McAfee customers during the outbreak of LNK exploits and one of the most frequent questions they asked was how it could have been possible without any buffer overflow. Lately, security practitioners had been putting a lot of focus on fuzzing and buffer overflow protection against zero-day vulnerabilities, but these design flaws in general operating systems and applications are allowing libraries and executable objects to be loaded from untrusted locations without exploiting any buffer overflow or memory corruption–by legitimate design.

The original advisory used iTunes as an example, but the same flaw is likely to exist in many applications. The attacker can plant a document or media file on a remote location that is opened by the application which loads external libraries insecurely. When the file is opened, a malicious library can be loaded from the remote location.

In the following example, a Microsoft application loads a document file “screen” from network drive Q:\ and tries to search for a DLL it requires on the same drive Q:\.

The DLL is loaded and running from the network drive Q:\.

McAfee VirusScan Enterprise users may choose to configure, and test, access protection rules to prevent access of at least “*.dll” and “*.ocx” from untrusted file locations where you share documents but are unlikely to be loading program libraries from:

In this case, notepad.exe tries to read a DLL from a network drive and the operation is prevented:

Note: This rule may also block nonmalicious applications from running on network drives and should be tested in each environment.

McAfee Labs is closely monitoring the exploitation of this technique in the wild and will provide more information as we find it.