PowerPoint, Firefox, other apps at risk from Windows vulnerability

DLL flaw could affect hundreds of applications, which would have to be patched individually

A vulnerability that Microsoft confirmed just yesterday is already being exploited, and the software giant says it can't fix the problem with a simple update. Instead, Microsoft says each affected application, many of them not under Microsoft's control, will have to be patched individually.

If you use Mozilla's Firefox Web browser, Microsoft PowerPoint or a peer-to-peer file-sharing application called uTorrent, you may already be compromised, according to a report in the British news site The Register. Hackers posted code to use the vulnerability to a hacker database, including specific exploits for several individual applications.

More than 200 applications could be vulnerable, according to Mitja Kolsek, CEO of Acros Security, the company based in Slovenia that first warned Microsoft of the weakness months ago.

According to Microsoft, the hack involves a problem with poorly written applications that call Dynamic Link Library (.dll) files without specifying a complete path. The application looks into the local directory for the library, and, at that point, it can load malware (disguised as the library file) that could enable the attacker to gain the same Windows network privileges as the user. While the mode of attack is old and well-known -- it's called .dll preloading, or binary planting -- the new wrinkle is that now attackers can launch it from remote servers.

So how big a deal is it? According to a report in CNET, Windows Live Mail, Windows Movie Maker, Microsoft PowerPoint 2010, Office 2007, Firefox 3.6.8, Foxit Reader, Wireshark and uTorrent, are among the applications users have reported as vulnerable to the Offensive Security's Exploit.db database, said Mati Aharoni, founder of the security firm Offensive Security.

"Today we broke a record in the Exploit-db with the amount of exploits for various Windows applications submitted in one day...all based on the same vulnerability," Aharoni said in CNET. "Right now it's in the dozens," he said, but he expects there will be hundreds of vulnerable applications reported before too long.

For attackers to make use of the weakness, users have to play along, said Jerry Bryant, group manager for response communication at Microsoft, quoted in CNET.

"DLL planting requires significant user interaction and cannot be exploited by simply browsing to a Web page," Bryant said. "An attacker would have to convince a user to click a link to their SMB (Server Message Block) or WebDAV (Web-based Distributed Authoring and Versioning) share and then convince the user to open a file from that share which would trigger additional dialogs prompting the user to OK the action."

Adrian Kingsley-Hughes, writing in ZDNet, offered similar advice:

"Hundreds of applications being vulnerable and needing to be patches is going to be a major headache for end users," he wrote. "Not only with the patch and update load increase, but then there’s the added problem of application that are no longer being supported never seeing updates. My advice is that you should take care. Be especially wary of unsolicited links and documents sent to you by e-mail or other communication channels."

 

About the Author

Technology journalist Michael Hardy is a former FCW editor.

The 2015 Federal 100

Meet 100 women and men who are doing great things in federal IT.

Featured

  • Shutterstock image (by venimo): e-learning concept image, digital content and online webinar icons.

    Can MOOCs make the grade for federal training?

    Massive open online courses can offer specialized IT instruction on a flexible schedule and on the cheap. That may not always mesh with government's preference for structure and certification, however.

  • Shutterstock image (by edel): graduation cap and diploma.

    Cybersecurity: 6 schools with the right stuff

    The federal government craves more cybersecurity professionals. These six schools are helping meet that demand.

  • Rick Holgate

    Holgate to depart ATF

    Former ACT president will take a job with Gartner, follow his spouse to Vienna, Austria.

  • Are VA techies slacking off on Yammer?

    A new IG report cites security and productivity concerns associated with employees' use of the popular online collaboration tool.

  • Shutterstock image: digital fingerprint, cyber crime.

    Exclusive: The OPM breach details you haven't seen

    An official timeline of the Office of Personnel Management breach obtained by FCW pinpoints the hackers’ calibrated extraction of data, and the government's step-by-step response.

  • Stephen Warren

    Deputy CIO Warren exits VA

    The onetime acting CIO at Veterans Affairs will be taking over CIO duties at the Office of the Comptroller of the Currency.

  • Shutterstock image: monitoring factors of healthcare.

    DOD awards massive health records contract

    Leidos, Accenture and Cerner pull off an unexpected win of the multi-billion-dollar Defense Healthcare Management System Modernization contract, beating out the presumptive health-records leader.

  • Sweating the OPM data breach -- Illustration by Dragutin Cvijanovic

    Sweating the stolen data

    Millions of background-check records were compromised, OPM now says. Here's the jaw-dropping range of personal data that was exposed.

  • FCW magazine

    Let's talk about Alliant 2

    The General Services Administration is going to great lengths to gather feedback on its IT services GWAC. Will it make for a better acquisition vehicle?

Reader comments

Thu, Aug 26, 2010 Larry

Out of the specific applications mentioned :"Windows Live Mail, Windows Movie Maker, Microsoft PowerPoint 2010, Office 2007, Firefox 3.6.8, Foxit Reader, Wireshark and uTorrent", why does the lead line in the email say "Firefox under fire"? The advice "My advice is that you should take care. Be especially wary of unsolicited links and documents sent to you by e-mail or other communication channels." is good, but applicable to every electronic threat. I think we need more specific advice for this low-risk threat.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above