CVE-2018-6461

Insecure Library Loading in March Hare WINCVS before 2.8.01 and CVS Suite before 2009R2 build 6610 via DLL files

• CVSS 7.8
• CWE-426 Untrusted Search Path
• Authentication, Authorization, and Session Management
• Local

March Hare WINCVS before 2.8.01 build 6610, and CVS Suite before 2009R2 build 6610, contains an Insecure Library Loading vulnerability in the wincvs2.exe or wincvs.exe file, which may allow local users to gain privileges via a Trojan horse Python or TCL DLL file in the current working directory.

CVE

CVE-2018-6461

CWE

CWE-426 Untrusted Search Path

CVSS base score

7.8

Published

2018-02-05

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update WINCVS to version 2.8.01 build 6610 or higher.

import os
import ctypes

def load_library(library_name):
    return ctypes.CDLL(library_name)

try:
    my_library = load_library("my_library.dll")
except Exception as e:
    print(f"Error: {e}")

import os
import ctypes

ALLOWED_LIBRARY_PATHS = ["/directory1", "/directory2"]

def load_library(library_name):
    library_path = os.path.abspath(library_name)
    
    if not any(library_path.startswith(allowed_path) for allowed_path in ALLOWED_LIBRARY_PATHS):
        raise ValueError(f"Library path {library_path} is not trusted.")
    
    return ctypes.CDLL(library_path)

try:
    my_library = load_library("my_library.dll")
except Exception as e:
    print(f"Error: {e}")

@misc{vaitp:cve20186461,
  title        = {{Insecure Library Loading in March Hare WINCVS before 2.8.01 and CVS Suite before 2009R2 build 6610 via DLL files}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2018},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2018-6461},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2018-6461/}}
}