[Full-disclosure] Maxthon Browser version 18.104.22.1680 Insecure DLL Hijacking Vulnerability (dwmapi.dll)
- From: YGN Ethical Hacker Group <lists@xxxxxxxx>
- Date: Sun, 29 Aug 2010 00:16:35 +0800
The Maxthon Browser application is vulnerable to Insecure DLL
Hijacking Vulnerability. Similar terms that describe this
have been come up with Remote Binary Planting, and Insecure DLL
2. PRODUCT DESCRIPTION
Maxthon Browser is a powerful tabbed browser built for all users.
Besides basic browsing functionality,
it provides a rich set of features
(http://www.maxthon.com/overview.htm) to improve web surfing
it has got over 400,000K+ downloads and one of the famous browsers.
3. VULNERABILITY DESCRIPTION
The Maxthon Browser application passes an insufficiently qualified
path in loading an external library, "dwmapi.dll"
when a user opens its associated file with extensions - htm, html, mhtml.
4. VERSIONS AFFECTED
22.214.171.1240 and lower version family of 2.x.x.x
Attackers can trigger a successful exploit against a victim user
through a number of ways such as placing a malicious external
library file together with an interesting file in network shares,
distributing it via usb drives, embedding it in archive files
that are released through file sharing networks.
Fixed version from the vendor has not been released yet.
However, it is suggested that the following workarounds be deployed by
users to protect increasing mass exploitation of this
- Disable loading of libraries from WebDAV and remote network shares
- Disable the WebClient service
Please see workaround solution links in References section.
Maxthon International Limited
This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.
10. DISCLOSURE TIME-LINE
08-28-2010: vulnerability discovered
08-28-2010: notified vendor
08-28-2010: vulnerability disclosed
Original Advisory URL:
Workaround Solution: http://support.microsoft.com/kb/2264107
Unofficial DLL Hijacking List:
YGN Ethical Hacker Group
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Prev by Date: [Full-disclosure] nonsense fun: 100 000 bit rsa key
- Next by Date: [Full-disclosure] QtWeb Browser version 3.3 build 043 Insecure DLL Hijacking Vulnerability (wintab32.dll)
- Previous by thread: [Full-disclosure] nonsense fun: 100 000 bit rsa key
- Next by thread: [Full-disclosure] QtWeb Browser version 3.3 build 043 Insecure DLL Hijacking Vulnerability (wintab32.dll)