{"id":13948,"date":"2020-04-04T00:17:00","date_gmt":"2020-04-03T22:17:00","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=13948"},"modified":"2020-04-03T22:17:12","modified_gmt":"2020-04-03T20:17:12","slug":"adwcleaner-8-0-4-closes-again-a-dll-hijacking-vulnerability","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2020\/04\/04\/adwcleaner-8-0-4-closes-again-a-dll-hijacking-vulnerability\/","title":{"rendered":"AdwCleaner 8.0.4 closes again a DLL Hijacking vulnerability"},"content":{"rendered":"

[German<\/a>]On March 3, 2020, Malwarebytes released the tool AdwCleaner 8.0.4. It's a maintenance release.  The update fixes a DLL hijacking vulnerability that I reported to the developers.<\/p>\n

<\/p>\n

\"\"In December 2019 I already had the blog post AdwCleaner 8.0.1 closes a DLL Hijacking vulnerability<\/a> here in the blog. This article was about a DLL hijacking vulnerability in this tool. There you can also find hints about what the AdwCleaner does. <\/p>\n

Again a DLL hijacking vulnerability in AdwCleaner 8.0.3 <\/h2>\n

Recently I had seen on the Internet that the AdwCleaner 8.0.3 is available. Out of an impulse I downloaded this version and then ran it over my testbed. The AdwCleaner does not need to be installed, but it requires administrative permissions at startup. The user will grant them, because he wants to clean his system from junkware.<\/p>\n

\"DLL-Hijacking-Schwachstelle<\/p>\n

After launching the tool, I was informed via the above dialog box that this version 8.0.3 of the AdwCleaner was vulnerable to DLL hijacking. This means that all DLL files loaded by the AdwCleaner are also executed as a process with administrative privileges. <\/p>\n

Normally this works well because Windows does not find the DLL files in the program's folder and then searches in the Windows folders. However, if a malware knows that a tool has a DLL hijacking vulnerability for certain DLLs, it only needs to place a file with the same name in the folder containing the application. For AdwCleaner, this is usually the Downloads folder. This DLL is then loaded instead of the Windows DLL (hijacking).  <\/p>\n

\n

The test bed is provided by Stefan Kanthak, who deals with such security issues. You can download the file Forward.cab<\/a> from his website and extract it into a folder. There is also a Sentinel.exe<\/a>, which has to be moved into this folder. <\/p>\n

If a virus scanner jumps on when you visit the Kanthak website: it delivers the Eicar test virus in a data block attribute on its website to test whether browsers evaluate it and load it into memory for execution. A virus scanner should then be activated.<\/p>\n<\/blockquote>\n

The developer reacts immediately<\/h2>\n

Since I was already in contact with him about the same problem with AdwCleaner 8.0.0, and the problem was solved with version 8.0.1, I sent him a mail. It took about 14 days until the answer. But the background was a vacation of the developer. Yesterday the developer informed me that AdwCleaner 8.0.4 was released with a bug fix. In the changelog, which is published here<\/a>:<\/p>\n

\n

We are pleased to release AdwCleaner 8.0.4! <\/p>\n

This versions is purely focused on maintenance to fix a bug that got reintroduced. The CVE number is pending assignment, this post will be updated when delivered. <\/p>\n

We updated the test suite to avoid this to happen again. <\/p>\n

See the full changelog below:<\/p>\n

## v8.0.4 [03\/04\/2020]<\/p>\n

### Changes
* Update definitions to 2020.04.03.1<\/p>\n

### Bugfixes
* Fix reintroduction of DLL loading vulnerability reintroduced in 8.0.3. CVE assignation pending.<\/p>\n<\/blockquote>\n

The download of AdwCleaner 8.0.4 is available on this website<\/a>. Of course I have run this version in the test bed after the download. The DLL hijacking vulnerability has been fixed. I have no idea what went wrong with them, that the old vulnerability in version 8.0.3 is included in the tool. <\/p>\n

Similar articles:
<\/strong>Malwarebytes AdwCleaner 8.0, a 2nd view<\/a>
AdwCleaner 8.0.1 closes a DLL Hijacking vulnerability<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

[German]On March 3, 2020, Malwarebytes released the tool AdwCleaner 8.0.4. It's a maintenance release.  The update fixes a DLL hijacking vulnerability that I reported to the developers.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,1547,2],"tags":[69,1544],"class_list":["post-13948","post","type-post","status-publish","format-standard","hentry","category-security","category-software","category-windows","tag-security","tag-software"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/13948","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=13948"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/13948\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=13948"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=13948"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=13948"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}