Title: Nevercenter Silo 2.1.1 Insecure Library Loading Vulnerability
Advisory ID: ZSL-2010-4972
Type: Local/Remote
Impact: System Access
Risk: (4/5)
Release Date: 08.11.2010

Summary

Silo 2 is a focused 3D modeling application with the ability to effortlessly switch between organically sculpting high-polygon models and precisely controlling hard-edged surfaces. It can be used for anything from creating 3D characters for video games and movies to quickly exploring 3D architectural ideas. Silo is currently being used at top studios worldwide as both a stand-alone design tool and as a versatile element of a multi-software 3D graphics workflow. It is available for both Windows and Mac OS.

Description

Silo 2 suffers from a DLL hijacking vulnerability, which could be exploited by remote attackers to compromise a vulnerable system. This issue is caused due to the application insecurely loading certain librairies ("wintab32.dll") from the current working directory, which could allow attackers to execute arbitrary code by tricking a user into opening an audio file (.sib) from a network share.

Vendor

Nevercenter Ltd. Co. - http://www.nevercenter.com

Affected Version

2.1.1

Tested On

Microsoft Windows XP Professional SP3 (EN)

Vendor Status

N/A

PoC

silo2_dll.c

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] http://www.exploit-db.com/dll-hijacking-vulnerable-applications/
[2] http://www.packetstormsecurity.org/filedesc/silo2-dllhijack.txt.html
[3] http://securityreason.com/exploitalert/9456
[4] http://secunia.com/advisories/42170/
[5] http://xforce.iss.net/xforce/xfdb/61321
[6] http://www.securelist.com/en/advisories/42170
[7] http://www.securityfocus.com/bid/44726

Changelog

[08.11.2010] - Initial release
[09.11.2010] - Added reference [1], [2], [3] and [4]
[11.11.2010] - Added reference [5]
[17.11.2010] - Added reference [6]
[19.11.2010] - Added reference [7]

Contact

Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk