360 Total Security 2016 suffers from a dll hijacking vulnerability.
eb621daae5b2ac3a59384ab24af18fcf4f0cc52479b52e2e3511d4c7597af98b
Aloha,
*360TSE_Setup_8.2.0.1039.exe* loads and executes WindowsCodecs.dll from its
"application directory".
For software downloaded with a web browser the applicationdirectory is
typically the user's "Downloads" directory: see <
https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html
>,
<http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html
>
and <http://seclists.org/fulldisclosure/2012/Aug/134> for "prior art" about
this well-known and well-documented vulnerability.
If an attacker places one of the above named DLL in the user's "Downloads"
directory (for example per "drive-by download" or "social engineering")
this vulnerability becomes a remote code execution.
Proof of concept/demonstration:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1. Create malicious dll file and save it as WindowsCodecs.dll in your
"Downloads" directory.
2. Download 360 Total Security 2016 installer from
https://www.360totalsecurity.com/en/
and save it in your "Downloads" directory.
3. Execute 360TSE_Setup_8.2.0.1039.exe from your "Downloads" directory.
4. Malicious dll file gets executed.
Chao!!
Thanks & Regards,
Himanshu Mehta