BugTraq
Re: OLE DB Provider for Oracle multiple DLL side loading vulnerabilities Feb 10 2016 07:29PM
Securify B.V. (lists securify nl)
------------------------------------------------------------------------

Fix
------------------------------------------------------------------------

Microsoft released MS16-014 that fixes this vulnerability.

On 16-12-15 19:27, Securify B.V. wrote:
> ------------------------------------------------------------------------

> OLE DB Provider for Oracle multiple DLL side loading vulnerabilities
> ------------------------------------------------------------------------

> Yorick Koster, August 2015
>
> ------------------------------------------------------------------------

> Abstract
> ------------------------------------------------------------------------

> Multiple DLL side loading vulnerabilities were found in the OLE DB
> Provider for Oracle. These issues can be exploited by loading various
> OLE components as an embedded OLE object. When instantiating the object
> Windows will try to load the DLLs oci.dll, and ociw32.dll from the
> current working directory. If an attacker convinces the user to open a
> specially crafted (Office) document from a directory also containing the
> attacker's DLL file, it is possible to execute arbitrary code with the
> privileges of the target user. This can potentially result in the
> attacker taking complete control of the affected system.
>
> ------------------------------------------------------------------------

> See also
> ------------------------------------------------------------------------

> http://www.greyhathacker.net/docs/OfficeDLLhijacking.zip
> https://securify.nl/blog/SFY20151201/there_s_a_party_in_ole__and_you_are
_invited.html
>
>
> ------------------------------------------------------------------------

> Tested versions
> ------------------------------------------------------------------------

> This issue was successfully verified on Windows 7 + Office 2007 32-bit,
> Windows Vista + Office 2010 32-bit, Windows 7 + Office 2013 32-bit.
>
> ------------------------------------------------------------------------

> Fix
> ------------------------------------------------------------------------

> There is currently no fix available.
>
> ------------------------------------------------------------------------

> Details
> ------------------------------------------------------------------------

> https://www.securify.nl/advisory/SFY20150806/ole_db_provider_for_oracle_
multiple_dll_side_loading_vulnerabilities.html
>

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus