Advisory: EnCase - Insecure Library Loading Allows Remote Code Execution (DLL Hijacking) [Update: 02.09.2010]

---------------------------------------------
EnCase - Insecure Library Loading Allows Remote Code Execution (DLL Hijacking)
Date: 29.08.2010
---------------------------------------------

- EnCase Description

From the simplest requirements to the most complex, EnCase Forensic is the premier computer forensic application on the market.

- Insecure Library Loading allows Remote Code Execution

This vulnerability was discovered using the Metasploit Framework with the following option: "set EXTENSIONS endump"

For more vulnerability details please check the links in the reference section.

- Affected Versions

v6.15.0.82/6.16.2/6.17.0.90 - other releases may also be affected.

- Solution

It is not known if there are fixed releases available.

- Credits

The vulnerability was discovered by m1k3 - m1k3#at#m1k3#dot#at

- Timeline

29.08.2010 - vulnerability discovered
29.08.2010 - public disclosure

- Reference

• http://www.guidancesoftware.com/forensic.htm
• http://www.microsoft.com/technet/security/advisory/2269637.mspx
• http://www.exploit-db.com/dll-hijacking-vulnerable-applications/
• http://blog.metasploit.com/2010/08/better-faster-stronger.html
• http://www.metasploit.com/modules/exploit/windows/browser/webdav_dll_hij...
• http://www.securityfocus.com/bid/42852
• http://www.s3cur1ty.de/advisories

- Exploiting example: