4 ms·
The linked article [1] has an explanation: In simple terms if an application (e.g. Test.exe) loads a DLL (e,g. foo.dll) by just the name, Windows follows
by jffry 11y ago
The linked article [1] has an explanation:
In simple terms if an application (e.g. Test.exe) loads
a DLL (e,g. foo.dll) by just the name, Windows follows
a specific search order depending upon whether
“SafeDllSearchMode” is enabled or disabled to
locate the legitimate DLL.
So it looks like the installer is legitimately attempting to load some DLL but either hasn't fully qualified the name or hasn't enabled this flag
[1]: http://blog.opensecurityresearch.com/2014/01/unsafe-dll-loading-vulnerabilities.html http://blog.opensecurityresearch.com/2014/01/unsafe-dll-load...
- wila 11y agoI was interested so read the article. Enabling the "SafeDllSearchMode" flag doesn't help as it is not the current directory from which the DLL is loaded, but the startup directory from which the installer is run (eg. the Downloads folder). The directory from which the application is loaded is still the first directory from which DLLs are loaded with "SafeDllSearchMode" on. Moving current directory down in the search order doesn't help. edit: The Microsoft Security Research center also had a paper on this [1] and there it lists that "SafeDllSearchMode" also employs a "known DLLs" technique when this flag has been set. Now the question is if Microsoft has added this DLL as a known DLL or not. I don't see it in my registry, but it might be defined elsewhere (or I might overlook it) [1] http://blogs.technet.com/b/srd/archive/2014/05/13/load-library-safely.aspx http://blogs.technet.com/b/srd/archive/2014/05/13/load-libra...