Hi Stefan and all, > See the "CWDIllegalInDllSearchPath" setting introduced with KB2264107 > about 5 years ago, after ACROS finally got enough attention for the > vulnerability first published as CVE-2000-0854 (that was 15 years ago, > but the vulnerability is still present in ALL installation programs): > there were^Ware applications that relied^Wy on loading DLLs from the > CWD, so Microsoft CAN'T exclude CWD from the PATH. > Microsoft can only offer support to exclude the CWD from the DLL search > order: developers can call SetDllDirectory(""), administrators can add > the global setting "CWDIllegalInDllSearchPath" or add this setting for > individual programs. While we finally did get CVE-2000-0854 the overdue attention, we apparently didn't promote this enough: http://ift.tt/1KWK7kU (presented at Source Boston in 2012). So now you'll have to do it - good luck :) BTW, Stefan, soon you'll be able to create your own patches for these, and many other bugs, with http://0patch.com. You're welcome. Cheers, Mitja Mitja Kolsek, CEO / @mkolsek ACROS, d.o.o. Makedonska ulica 113, SI - 2000 Maribor, Slovenia Tel +386.2.3000.280 Fax +386.2.3000.282 Web http://ift.tt/1MGLKkb Blg http://ift.tt/1OkGA34 Twt @acrossecurity ACROS Security: Finding Your Digital Vulnerabilities Before Others Do
Source: Gmail -> IFTTT-> Blogger
No comments:
Post a Comment