exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

NPS Datastore Server DLL Hijacking

NPS Datastore Server DLL Hijacking
Posted Feb 11, 2016
Authored by Yorick Koster, Securify B.V.

A DLL side loading vulnerability was found in the NPS Datastore server DLL that ships with Windows Vista. This issue can be exploited by loading the affected DLL as an embedded OLE object. When instantiating the object Windows will try to load the DLL iasdatastore2.dll from the current working directory. If an attacker convinces the user to open a specially crafted (Office) document from a directory also containing the attacker's DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system.

tags | advisory, arbitrary
systems | windows
advisories | CVE-2016-0041
SHA-256 | 1b2dddead234857b365162684d8bbf28ae57f80f5af04c34105b408b35df5d6e

NPS Datastore Server DLL Hijacking

Change Mirror Download
------------------------------------------------------------------------
NPS Datastore server DLL side loading vulnerability
------------------------------------------------------------------------
Yorick Koster, September 2015

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A DLL side loading vulnerability was found in the NPS Datastore server
DLL that ships with Windows Vista. This issue can be exploited by
loading the affected DLL as an embedded OLE object. When instantiating
the object Windows will try to load the DLL iasdatastore2.dll from the
current working directory. If an attacker convinces the user to open a
specially crafted (Office) document from a directory also containing the
attacker's DLL file, it is possible to execute arbitrary code with the
privileges of the target user. This can potentially result in the
attacker taking complete control of the affected system.

------------------------------------------------------------------------
See also
------------------------------------------------------------------------
- CVE-2016-0041
- MS16-014: Security Update for Microsoft Windows to Address Remote
Code Execution (3134228)

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully verified on Windows Vista + Office 2010
32-bit.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Microsoft released MS16-014 that fixes this vulnerability.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20150905/nps_datastore_server_dll_side_loading_vulnerability.html
Login or Register to add favorites

File Archive:

August 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    15 Files
  • 2
    Aug 2nd
    22 Files
  • 3
    Aug 3rd
    0 Files
  • 4
    Aug 4th
    0 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    11 Files
  • 7
    Aug 7th
    43 Files
  • 8
    Aug 8th
    42 Files
  • 9
    Aug 9th
    36 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    27 Files
  • 13
    Aug 13th
    18 Files
  • 14
    Aug 14th
    50 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close