RETIRED: Microsoft Windows Mail 'wab32res.dll' DLL Loading Arbitrary Code Execution Vulnerability

Bugtraq ID:	42818
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 27 2010 12:00AM
Updated:	Nov 03 2011 08:03PM
Credit:	Fishy Fish
Vulnerable:	Microsoft Windows Mail 6.0.60000 16386 + Microsoft Windows Vista 0 + Microsoft Windows Vista x64 Edition 0 Microsoft Windows Mail 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista x64 Edition 0
Not Vulnerable:

RETIRED: Microsoft Windows Mail 'wab32res.dll' DLL Loading Arbitrary Code Execution Vulnerability

Microsoft Windows Mail is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

This BID is being retired. The issue discussed is already documented in BID 42648 (Microsoft Windows Address Book 'wab32res.dll' DLL Loading Arbitrary Code Execution Vulnerability).

RETIRED: Microsoft Windows Mail 'wab32res.dll' DLL Loading Arbitrary Code Execution Vulnerability

Attackers must trick a user into opening a file on a remote WebDAV or SMB share to exploit this issue.

A general exploit technique has been documented by TheLeader and H.D. Moore for the Metasploit Project; please see the references for more information.

RETIRED: Microsoft Windows Mail 'wab32res.dll' DLL Loading Arbitrary Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Microsoft Windows Mail 'wab32res.dll' DLL Loading Arbitrary Code Execution Vulnerability

References:

• Application DLL Load Hijacking (HD Moore)
  
• Exploiting DLL Hijacking Flaws (hdm)
  
• Microsoft Homepage (Microsoft)
  
• Microsoft Security Advisory 2269637 Released (Microsoft)
  
• More information about the DLL Preloading remote attack vector (Microsoft)
  
• Microsoft Security Advisory (2269637) (Microsoft)