Exploit the possiblities

Corel Software DLL Hijacking

Corel Software DLL Hijacking
Posted Jan 13, 2015
Authored by Core Security Technologies, Marcos Accossatto | Site coresecurity.com

Various Corel software suffers from a DLL hijacking vulnerability. When a file associated with the Corel software is opened, the directory of that document is first used to locate DLLs, which could allow an attacker to execute arbitrary commands by inserting malicious DLLs into the same directory as the document.

tags | exploit, arbitrary
systems | windows
advisories | CVE-2014-8393, CVE-2014-8394, CVE-2014-8395, CVE-2014-8396, CVE-2014-8397, CVE-2014-8398
MD5 | 74b9b0456e1bc2ec9edc9f1342760a4d

Corel Software DLL Hijacking

Change Mirror Download
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

Corel Software DLL Hijacking



1. *Advisory Information*

Title: Corel Software DLL Hijacking
Advisory ID: CORE-2015-0001
Advisory URL:
http://www.coresecurity.com/advisories/corel-software-dll-hijacking
Date published: 2015-01-12
Date of last update: 2015-01-06
Vendors contacted: Corel
Release mode: User release



2. *Vulnerability Information*

Class: Uncontrolled Search Path Element [CWE-427]
Impact: Code execution
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2014-8393, CVE-2014-8394, CVE-2014-8395, CVE-2014-8396,
CVE-2014-8397, CVE-2014-8398



3. *Vulnerability Description*


Corel [1] has developed a wide range of products that includes graphics, painting,
photo, video and office software.(CorelDRAW,Corel Photo-Paint, Corel PaintShop Pro, Corel CAD,
Corel Painter, Corel PDF Fusion, Corel VideoStudio and Corel FastFlick among others)



When a file associated with the Corel software is opened, the directory of that document
is first used to locate DLLs, which could allow an attacker to execute arbitrary commands
by inserting malicious DLLs into the same directory as the document.



4. *Vulnerable packages*

. Corel DRAW X7 [2]
. Corel Photo-Paint X7 [3]
. Corel PaintShop Pro X7 [7]
. Corel CAD 2014 [4]
. Corel Painter 2015 [5]
. Corel PDF Fusion [6]
. Corel VideoStudio PRO X7 [8]
. Corel FastFlick [9]

Other versions could be affected too, but they were not checked.


5. *Vendor Information, Solutions and Workarounds*


Given that this is a client-side vulnerability, affected users should avoid opening untrusted
files whose extensions are associated with Corel software and contain any of the DLL files detailed below.



6. *Credits*


This vulnerability was discovered and researched by Marcos Accossatto from Core Security
Exploit Writers Team. The publication of this advisory was coordinated by Joaquin Rodriguez
Varela from Core Advisories Team.



7. *Technical Description / Proof of Concept Code*

[CVE-2014-8393] This vulnerability is caused by a DLL Hijacking when a file
associated with any of the following Corel applications is executed (CorelDRAW X7, Corel
Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015 or Corel PDF Fusion). The
affected application should not be running for the vulnerability to work. The Corel
software looks for a DLL file called "wintab32.dll" and does not control its path, therefore
allowing to copy a malicious DLL file with the same name inside the folder where the
associated file is. The DLL is executed within the context of the application.


[CVE-2014-8394] This vulnerability is caused by a DLL Hijacking when a file
associated with Corel CAD 2014 is executed. Corel CAD 2014 should not be running before
the associated file is executed for the vulnerability to work.
Corel CAD looks for a DLL file called "FxManagedCommands_3.08_9.tx" or "TD_Mgd_3.08_9.dll"
and does not control their path, therefore allowing to copy a malicious DLL file with the
same name of either DLL inside the folder where the associated file is. The DLL is
executed within the context of the application.


[CVE-2014-8395] This vulnerability is caused by a DLL Hijacking when a file associated with
Corel Painter 2015 is executed. Corel Painter 2015 should not be running before the associated
file is executed for the vulnerability to work. Corel Painter looks for a DLL file called
"wacommt.dll" and does not control its path, therefore allowing to copy a malicious DLL file
with the same name inside the folder where the associated file is. The DLL is executed within
the context of the application.


[CVE-2014-8396] This vulnerability is caused by a DLL Hijacking when a file associated with
Corel PDF Fusion is executed. Corel PDF Fusion should not be running before the associated
file is executed for the vulnerability to work. Corel PDF Fusion looks for a DLL file called
"quserex.dll" and does not control its path, therefore allowing to copy a malicious DLL file
with the same name inside the folder where the associated file is. The DLL is executed within
the context of the application.


[CVE-2014-8397] This vulnerability is caused by a DLL Hijacking when a file associated with
Corel VideoStudio PRO X7 or Corel FastFlix is executed. Corel Video Studio or Corel FastFlix
should not be running before the associated file is executed for the vulnerability to work.
Corel PDF Fusion looks for a DLL file called "u32ZLib.dll" and does not control its path,
therefore allowing to copy a malicious DLL file with the same name inside the folder where the
associated file is. The DLL is executed within the context of the application.


[CVE-2014-8398] This vulnerability is caused by a DLL Hijacking when a file associated with
Corel FastFlick is executed. Corel FastFlick should not be running before the associated file
is executed for the vulnerability to work. Corel FastFlick looks for DLL files called "igfxcmrt32.dll",
"ipl.dll", "MSPStyleLib.dll", "uFioUtil.dll", "uhDSPlay.dll", "uipl.dll", "uvipl.dll", "VC1DecDll.dll" or
"VC1DecDll_SSE3.dll" and does not control their path, therefore allowing to copy a malicious DLL file with
the same name of any of those DLLs inside the folder where the associated file is. The DLL is executed
within the context of the application.



8. *Report Timeline*

. 2014-12-09:
Core Security notifies Corel of the vulnerabilities. Publication date is
set for January 5th, 2015.


. 2014-12-17:
Core Security requests an acknowledgement of the mail previously sent.
Informs that if no answer
is registered the advisory will be pubilshed as "user release".


. 2015-01-02:
Core Security tries to contact the vendor through their twitter account
without any luck.


. 2015-01-12:
Advisory CORE-2015-0001 published as user release.



9. *References*

[1] http://www.corel.com/.
[2] http://www.coreldraw.com/la/product/diseno-grafico-creativo/?hptrack=la2bb1.
[3] http://www.coreldraw.com/la/pages/photo-paint/.
[4] http://www.coreldraw.com/us/product/cad-software/.
[5] http://www.painterartist.com/us/product/paint-program/.
[6] http://www.wordperfect.com/us/product/pdf-creator/.
[7] http://learn.corel.com/photo/courses/course/PaintShop-Pro-X7-Tutorials.
[8] http://learn.corel.com/video/tutorials/view/232/What-s-New-in-Corel-VideoStudio-Pro-X7.
[9] http://learn.corel.com/video/tutorials/view/236/How-to-Use-FastFlick.


10. *About CoreLabs*

CoreLabs, the research center of Core Security, is charged with
anticipating the future needs and requirements for information security
technologies. We conduct our research in several important areas of computer
security including system vulnerabilities, cyber attack planning and
simulation, source code auditing, and cryptography. Our results include problem
formalization, identification of vulnerabilities, novel solutions and
prototypes for new technologies. CoreLabs regularly publishes security
advisories, technical papers, project information and shared software
tools for public use at: http://corelabs.coresecurity.com.



11. *About Core Security*


Core Security enables organizations to get ahead of threats
with security test and measurement solutions that continuously
identify and demonstrate real-world exposures to their most critical
assets. Our customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.



Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security
can be reached at +1 (617) 399-6980 or on the Web at:
http://www.coresecurity.com.



12. *Disclaimer*


The contents of this advisory are copyright
(c) 2014 Core Security and (c) 2014 CoreLabs,
and are licensed under a Creative Commons
Attribution Non-Commercial Share-Alike 3.0 (United States) License:
http://creativecommons.org/licenses/by-nc-sa/3.0/us/


13. *PGP/GPG Keys*


This advisory has been signed with the GPG key of Core Security
advisories team, which is available for download at:

http://www.coresecurity.com/files/attachments/core_security_advisories.asc.


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    22 Files
  • 2
    Nov 2nd
    28 Files
  • 3
    Nov 3rd
    10 Files
  • 4
    Nov 4th
    1 Files
  • 5
    Nov 5th
    5 Files
  • 6
    Nov 6th
    15 Files
  • 7
    Nov 7th
    15 Files
  • 8
    Nov 8th
    13 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    9 Files
  • 11
    Nov 11th
    3 Files
  • 12
    Nov 12th
    2 Files
  • 13
    Nov 13th
    15 Files
  • 14
    Nov 14th
    17 Files
  • 15
    Nov 15th
    19 Files
  • 16
    Nov 16th
    15 Files
  • 17
    Nov 17th
    19 Files
  • 18
    Nov 18th
    4 Files
  • 19
    Nov 19th
    2 Files
  • 20
    Nov 20th
    9 Files
  • 21
    Nov 21st
    15 Files
  • 22
    Nov 22nd
    23 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close