Filed under: OS Updates, Security, Windows
It seems an old, well-known Windows DLL issue might soon find its way into a virus near you!
I wouldn't worry too much though. As I said, it's a very old issue that hasn't been fixed in a long time. Basically, DLL files are libraries of functions. Most programs load a bunch of DLLs when they start-up, and if you can infect those DLLs -- or replace them with malicious counterparts -- then you can very easily hack the system. The problem is exacerbated by the fact that one DLL might call any number of other DLLs. Still, the problem remains that you have to get those bad DLLs onto the user's system, which isn't easy.
CNet has more information, direct from Microsoft:
"At this time, we encourage customers to review and apply the guidance in Security Advisory 2269637. Also, it should be noted that DLL planting requires significant user interaction and cannot be exploited by simply browsing to a web page. An attacker would have to convince a user to click a link to their SMB (Server Message Block) or WebDAV (Web-based Distributed Authoring and Versioning) share and then convince the user to open a file from that share which would trigger additional dialogs prompting the user to OK the action."
As you can see, you and I aren't going to be fooled by this new attack vector -- but it might be worth telling your friends and family about it! This nasty little bug won't be going away for some time, and dozens of very popular Windows programs like Office 2007, µTorrent, and Firefox 3.6.8 are vulnerable.
For further reading, here's a published example of how you might exploit iTunes on Windows. Offensive Security even has a video of the exploit in action! Again, don't worry too much -- just don't click any odd links from people you don't trust and you'll be fine.Windows DLL exploit could cause problems, and there's no immediate fix available originally appeared on Download Squad on Wed, 25 Aug 2010 12:30:00 EST. Please see our terms for use of feeds.Read | Permalink | Email this | Comments
