Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> The link you gave gives a single line description of the issue. It isn't very helpful in understanding what conditions were required to exploit. Is this a Sandboxie installer issue or all installers?

The single line description is literally an answer to both of those questions, "Sandboxie installer 5071703 has a DLL Hijacking or Unsafe DLL Loading Vulnerability via a Trojan horse dwmapi.dll or profapi.dll file in an AppData\Local\Temp directory."

> Edit: ok, read the medium link at the bottom. This is an issue with Sandboxie's installer behavior, for which I think it is unfair to blame the way Windows searches for and loads DLLs.

The vulnerability is literally caused by the dll load path containing the cwd. That is the subject of this entire thread.



If that were true, it'd be applicable to every installer on earth. Sandboxie installer does something it shouldn't.

But hey, fuck it, let's throw the baby out with the bathwater and have namespace conflicts because now all DLLs must be in system32 or some bullshit.

For that matter, let's just not use computers at all! That's where vulnerabilities come from after all.


None of that has anything to do with the discussion about binary planting, one variant of which is dll planting due to the cwd directory being used as a path component in microsoft windows versions.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: