Libexpat Expat CVE-2017-11742 DLL Loading Remote Code Execution Vulnerability

Bugtraq ID:	100147
Class:	Design Error
CVE:	CVE-2017-11742
Remote:	Yes
Local:	No
Published:	Aug 07 2017 12:00AM
Updated:	Aug 07 2017 12:00AM
Credit:	Sebastian.
Vulnerable:	Libexpat Expat 2.2.2 Libexpat Expat 2.2.1
Not Vulnerable:	Libexpat Expat 2.2.3

Libexpat Expat CVE-2017-11742 DLL Loading Remote Code Execution Vulnerability

Expat is prone to a remote code-execution vulnerability.

A remote attacker can leverage this issue to execute arbitrary code in the context of the affected application.

Expat versions later than 2.2.1 and 2.2.2 are vulnerable.

Libexpat Expat CVE-2017-11742 DLL Loading Remote Code Execution Vulnerability

Attackers must trick a user into opening a file on a remote WebDAV or SMB share to exploit this issue.

A general exploit technique has been documented by TheLeader and H.D. Moore for the Metasploit Project; please see the references for more information.

Libexpat Expat CVE-2017-11742 DLL Loading Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Libexpat Expat CVE-2017-11742 DLL Loading Remote Code Execution Vulnerability

References:

• Expat Homepage (Expat)
  
• Exploiting DLL Hijacking Flaws (hdm)
  
• More information about the DLL Preloading remote attack vector (Microsoft)
  
• [2.2.{1,2}] Windows LoadLibrary DLL hijacking vulnerability (CVE-2017-11742) #82 (Github)
  
• Changes (Github)