Flux's dll hijacking vulnerability
How is the flux team, working on patching this dll hijacking vulnerability? Or is the vulnerability already fixed?
"flux-setup.exe" loads and executes dll from its "application directory".
For software downloaded with a web browser the applicationdirectory is
typically the user's "Downloads" directory: see <
and http://seclists.org/fulldisclosure/2012/Aug/134 for "prior art" about
this well-known and well-documented vulnerability.
If an attacker places malicious DLL in the user's "Downloads" directory
(for example per "drive-by download" or "social engineering") this
vulnerability becomes a remote code execution.
Proof of concept/demonstration:
1. Create a malicious dll file and save it in your "Downloads" directory. 2. Download "flux-setup.exe" from https://justgetflux.com/ and save it in your "Downloads" directory. 3. Execute "flux-setup.exe" from your "Downloads" directory. 4. Malicious dll file gets executed.
This is patched in the 3.11 build:
It is not the main download right now because we are trying to enable XP and Windows 10 Anniversary signing in one build. (Currently this one will install on Win7+).
Thanks for the reply and the help!