Bentley Microstation Multiple DLL Loading Arbitrary Code Execution Vulnerability

Bugtraq ID:	42769
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 26 2010 12:00AM
Updated:	Mar 19 2015 09:27AM
Credit:	Kalyan
Vulnerable:	Bentley Systems, Incorporated Microstation 7.1
Not Vulnerable:

Bentley Microstation Multiple DLL Loading Arbitrary Code Execution Vulnerability

Bentley Microstation is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

Bentley Microstation Multiple DLL Loading Arbitrary Code Execution Vulnerability

Attackers must trick a victim into opening a file on a remote WebDAV or SMB share to exploit this issue.

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Bentley Microstation Multiple DLL Loading Arbitrary Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Bentley Microstation Multiple DLL Loading Arbitrary Code Execution Vulnerability

References:

• Application DLL Load Hijacking (HD Moore)
  
• CAD 2D-3D Pipe designing software Microstation, Nero, Quicktime Pictureviwer vul (kalyan)
  
• Exploiting DLL Hijacking Flaws (hdm)
  
• Microsoft Security Advisory 2269637 Released (Microsoft)
  
• More information about the DLL Preloading remote attack vector (Microsoft)
  
• Microsoft Security Advisory (2269637) (Microsoft)