Microsoft Office / COM Object - DLL Planting with 'comsvcs.dll' Delay Load of 'mqrt.dll' (MS15-132)

Source: https://code.google.com/p/google-security-research/issues/detail?id=556 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially crafted OLE object. This attack also works on Office 2013 running on Windows 7 x64. Other...

Schneider Electric Pelco DS-NVs Buffer Overflow Vulnerability

OVERVIEW NCCIC/ICS-CERT received a report from HP’s Zero Day Initiative ZDI concerning a buffer overflow vulnerability in Schneider Electric’s Pelco DS-NVs software package. This vulnerability was reported to ZDI by security researchers Ariele Caltabiano and Andrea Micalizzi. Schneider Electric h...

Cimon CmnView DLL Hijacking Vulnerability

OVERVIEW Ivan Sanchez of Wise Security has identified a DLL Hijacking vulnerability in the CIMON CmnView.exe application. CIMON, Inc. has produced a patch that mitigates this vulnerability. This vulnerability could be exploited remotely with social engineering and requires local user input...

Elipse E3 Process Control Vulnerability

OVERVIEW Ivan Sanchez from Nullcode Team has identified a process control vulnerability in the Elipse E3 application. The process control vulnerability is a result of a third-party DLL, developed by Telerik, which is used in the Elipse E3 application. Elipse has released a new version that...

Google Chrome DLL Hijack

Hi @ll, the executable installers ° of Google Chrome are vulnerable: 1. ChromeStandaloneSetup.exe and ChromeSetup.exe load and execute a rogue/bogus/malicious CryptBase.dll under Windows NT6.x from their "application directory" '. For software downloaded with a web browser this is typically the...

7-Zip DLL Hijack

Hi @ll, the executable installers ° of 7-Zip see and ALL self-extracting archives created with 7-Zip are vulnerable: 1. They load and execute a rogue/bogus/malicious UXTheme.dll ' eventually found in the directory they are started from the "application directory". For software downloaded with a w...

Microsoft Office Excel Remote Code Execution Vulnerabilities (3116111)

This host is missing a critical security update according to Microsoft Bulletin MS15-131. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

MS15-134 Microsoft Office COM Object DLL Planting with els.dll

While loading an embedded object in Microsoft Word or other Microsoft Office products, it is possible to load a Classic Event Viewer Extension, which causes a LoadLibraryW call that attempts to load elsext.dll from the same directory as the Office document. From an untrusted remote share such as...

Microsoft Office / COM Object - 'els.dll' DLL Planting (MS15-134)

Source: https://code.google.com/p/google-security-research/issues/detail?id=514 It is possible for an attacker to execute a DLL planting attack in Microsoft Office with a specially crafted OLE object. Testing was performed on a Windows 7 x64 virtual machine with Office 2013 installed and the late...

Microsoft Office COM Object - els.dll DLL Planting (MS15-134)

Microsoft Office COM Object - els.dll DLL Planting MS15-134 Source: https://code.google.com/p/google-security-research/issues/detail?id=514 It is possible for an attacker to execute a DLL planting attack in Microsoft Office with a specially crafted OLE object. Testing was performed on a Windows 7...

Microsoft Office Compatibility Pack Remote Code Execution Vulnerabilities (3116111)

This host is missing a critical security update according to Microsoft Bulletin MS15-113. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Windows Excel Viewer Remote Code Execution Vulnerabilities (3116111)

This host is missing a critical security update according to Microsoft Bulletin MS15-131. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Windows CVE-2015-6128 DLL Loading Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition. Note: This issue was previously titl...

SumatraPDF DLL Hijack

Hi @ll, the executable installers ° of all versions of SumatraPDF see are vulnerable: 1. On Windows Embedded POSReady 2009 alias Windows XP SP3 the installer of the current version 3.1.1 loads and executes a rogue/bogus/malicious DCIMan32.dll ' eventually found in the directory it is started from...

JRSoft InnoSetup DLL Hijack

Hi @ll, executable installers ° created with JRSoft InnoSetup see ; this includes of course InnoSetup itself too are vulnerable: 1. They load and execute a rogue/bogus/malicious UXTheme.dll ' eventually found in the directory they are started from the "application directory". For software...

Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)

require 'zip' require 'base64' require 'msf/core' require 'rex/ole' class MetasploitModule 'Office OLE Multiple DLL Side Loading Vulnerabilities', 'Description' = %q Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various...

VLC DLL Hijack

Hi @ll, the executable installers ° of the videolan client VLC, see are vulnerable: 1. They load and execute a rogue/bogus/malicious ShFolder.dll '² and other DLLs like SetupAPI.dll or UXTheme.dll too eventually found in the directory they are started from the "application directory". For softwar...

Rockwell Automation FactoryTalk DLL Hijacking Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on March 3, 2015, and is being released to the NCCIC/ICS-CERT web site. Ivan Sanchez of NullCode & Evilcode Team has identified multiple DLL Hijacking vulnerabilities in a software component included with Rockwell...

迅雷权限提升漏洞

迅雷下载东西的时候，会调用我们安装迅雷后一个htm文件，去激活htm文件里的一些代码， 把我们所下载东西添加到列表当中。 所对应的htm文件有2处： C:\Program Files\Thunder Network\Thunder\Program\geturl.htm C:\Program Files\Thunder Network\Thunder\Program\getAllurl.htm 如果我们想把我们想要的代码添加进去执行了？ 我们简单写个代码试试，代码如下： Set vbs=CreateObject"Wscript.Shell" vbs.run "cmd /c net user...

迅雷极速版权限提升漏洞

迅雷下载东西的时候，会调用我们安装迅雷后一个htm文件，去激活htm文件里的一些代码， 把我们所下载东西添加到列表当中。 所对应的htm文件有2处： C:\Program Files\Thunder Network\Thunder\Program\geturl.htm C:\Program Files\Thunder Network\Thunder\Program\getAllurl.htm 如果我们想把我们想要的代码添加进去执行了？ 我们简单写个代码试试，代码如下： Set vbs=CreateObject"Wscript.Shell" vbs.run "cmd /c net user...