Microsoft Windows DLL Search Path Weakness

The following is a demonstration provided by Georgi Guninski <guninski@guninski.com> :

Demonstration:
1) Download dll1.cpp from http://www.guninski.com/dll1.cpp and build it. The compiled version is at: http://www.guninski.com/dll1.dll
2) Rename dll1.dll to riched20.dll
3) Place riched20.dll in a directory of your choice
4) Close all Office applications
5) From Windows Explorer double click on an Office document (preferably MS Word document) in the directory containg riched20.dll


 

Privacy Statement
Copyright 2010, SecurityFocus