========================================================================================= Adobe Flash Player IE version 10.1.x Insecure DLL Hijacking Vulnerability (dwmapi.dll) ========================================================================================= 1. OVERVIEW The Flash Player application is vulnerable to Insecure DLL Hijacking Vulnerability. Similar terms that describe this vulnerability have been come up with Remote Binary Planting, and Insecure DLL Loading/Injection/Hijacking/Preloading. 2. PRODUCT DESCRIPTION Adobe Flash Player is the standard for delivering high-impact, rich Web content. Designs, animation, and application user interfaces are deployed immediately across all browsers and platforms, attracting and engaging users with a rich Web experience. 3. VULNERABILITY DESCRIPTION The Flash Player application passes an insufficiently qualified path in loading its external libraries - "dwmapi.dll", which must be present at user's desktop when a user visits web sites with flash contents. 4. VERSIONS AFFECTED 10.1.x (other versions might be affected as well) 5. PROOF-OF-CONCEPT/EXPLOIT http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/flash_player/poc/movie/flash_player_ie_10.x_dll_hijacking_vuln.mp4 Tested Platform: OS: Windows XP Service Pack 3 (Fresh Windows) Flash version: 10.1.82.76 6. IMPACT Attackers can trigger a successful exploit against a victim user by triggering user to save a malicious dll file in user's Desktop or if user's default download save location is his Desktop. This is not a case at least in the past where there have been cases such as old versions of Apple Safari Browser automatically saving files in user' desktop location, which implies that those who still have older versions of Safari browser (version 3.1.1 and lower) are victims of this issue. 7. SOLUTION Fixed version from the vendor has not been released yet. However, it is suggested that the following workaround be deployed by users to protect increasing mass exploitation of this vulnerability class: - Avoid saving dll files from untrusted sources to Desktop location 8. VENDOR Adobe Inc (http://www.adobe.com) 9. CREDIT This vulnerability was discovered by Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar. 10. DISCLOSURE TIME-LINE 09-02-2010: vulnerability discovered 09-03-2010: notified vendor 09-10-2010: vulnerability disclosed 11. REFERENCES Original Advisory URL: http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/[flash_player]_10.1.x_insecure_dll_hijacking_(dwmapi.dll) Related: http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx Related: https://www.microsoft.com/technet/security/advisory/953818.mspx Unofficial DLL Hijacking List: http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/ Testing for DLL Hijacking: http://core.yehg.net/lab/pr0js/view.php/when_testing_for_dll_hijacking.txt #yehg [09-10-2010]