Abstract
Multiple DLL side loading vulnerabilities were found in the Event Viewer Snapin that ships with Windows. These issues can be exploited by loading various COM components as an embedded OLE object. When instantiating vulnerable object Windows will try to load the DLL elsext.dll from the current working directory. If an attacker convinces the user to open a specially crafted (Office) document from a directory also containing the attacker's DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system.
See also
- CVE-2015-6128
- CVE-2015-6132
- MS15-132: Security Update for Microsoft Windows to Address Remote Code Execution (3116162)
- OfficeDLLhijacking.zip
- Issue 514: Microsoft Office / COM Object DLL Planting with els.dll
- SFY20151201: There's a party in OLE, and you are invited
- ms15_132_dll_sideload.rb
Tested versions
This issue was successfully verified on Windows 7 + Office 2007 32-bit, Windows Vista + Office 2010 32-bit, Windows 7 + Office 2013 32-bit.
Fix
Microsoft released MS15-132 that fixes this vulnerability.
Introduction
OLE is a technology that enables an application to create compound documents that contain information from a number of different sources. For example, a document in an OLE-enabled word processor can accept an embedded spreadsheet object. Unlike traditional "cut and paste" methods where the receiving application changes the format of the pasted information, embedded documents retain all their original properties. If the user decides to edit the embedded data, Windows activates the originating application and loads the embedded document.
OLE objects are loaded via a CLSID or indirectly via a programmatic identifier (ProgID). The CLSID is used to look up its associated DLL in the Windows Registry. In order to check if the provided CLSID is in fact an OLE object, this DLL needs to be loaded in memory first, even if the CLSID is not really an OLE object. Since the DLL may not be designed to be loaded this way, loading it can introduce security issues like side loading of malicious DLLs.
Vulnerability details
It was discovered that the Event Viewer Snapin of Windows is affected by multiple DLL side loading vulnerabilities. Loading the following COM components as an OLE object will result in Windows trying to load the DLL elsext.dll from the current working directory:
- CLSID
{394C052E-B830-11D0-9A86-00C04FD8DBF7} - CLSID
{975797FC-4E2A-11D0-B702-00C04FD8DBF7} - CLSID
{F778C6B4-C08B-11D2-976C-00C04F79DB19}
This issue exists in the InitExtension() method. When called, this method will try to load the DLL elsext.dll using a relative path. This causes Windows to also search the current working directory.
Figure 1: elsext.dll loaded from a relative path
An attacker can exploit this issue by convincing a target user into opening a specially crafted (Office) document from a directory containing the attacker's DLL. This allows for the execution of arbitrary code that will be executed with the privileges of the target user, potentially resulting in a full compromise of the affected system.