Insecure DLL Loading and Command Execution Issues on Many Windows Application Programs. Various Windows application programs (including installers and self-extracting archives) are reported to load Dynamic Link Libraries insecurely and/or invoke executable files insecurely.

Description Various Windows application programs, especially installers and self-extracting archives, are reported to load Dynamic Link Libraries insecurely. Those application programs search and load Dynamic Link Libraries from the same directory as the programs reside, before searching system directories. Typically, Windows application programs are installed in some system directories, and no user can place, remove, modify files on system directories without administrative privilege. Thus, the risk of being tricked to place malicious files on the same directory as application programs is low. On the other hand, installers, self-extracting archives, and portable apps tend to be placed on users' home directory or its sub directory, and the risk of exploiting insecure Dynamic Link Library loading issue is high. Many software installers are reported to load Dynamic Link Libraries insecurely.

Most of them are created using some installer-packaging tools, and the vulnerability comes from the components provided by those tools. Application developers should use the latest and updated installer-packaging tools to mitigate the insecure Dynamic Link Library loading, but reports indicate that old vulnerable versions are still used. References: InstallShield NSIS (Nullsoft Scriptable Install System) The WiX Toolkit Inno Setup 5 Some of Windows standard DLLs are observed to load other standard DLLs from the same directory as the application programs. Canon l10576e driver windows 7 update. Self-extracting archives created using iexpress utility load DLLs from the same directory, too. As explained in the following subsection, Microsoft classifies insecure Dynamic Link Library loading issue to two type 'Application Directory Type' and 'Current Directory Type', and treats the behavior of standard DLLs and iexpress archives above as 'Application Directory Type'. Microsoft rates the severity of 'Application Directory Type' vulnerability as low, and planning no security updates. You should confirm that there are no untrusted files in the same directory as the program before invoking it, or, should copy the program to some trusted directory or a newly-created temporary directory.

'Application Directory Type' and 'Current Directory Type' Microsoft classifies the insecure DLL loading issue to two type: 'Application Directory Type' and 'Current Directory Type'. 'Application Directory Type' DLL loading means searching a DLL from the same directory as the program, before the intended directories (system directories in most cases). It may result in loading an unexpected DLL. 'Current Directory Type' DLL loading means searching a DLL from the same directory as the data file which a victim user double-clicks on to invoke the associated application program.

Microsoft rates the severity of 'Application Directory Type' vulnerability as low, and planning no security updates. Security Updates are provided for 'Current Directory Type' issues, for example,. Self-Extracting Archives created with archivers Some self-extracting archives are reported to load Dynamic Link Libraries insecurely.