DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org AB8B33858D33
MIME-Version: 1.0
Date: Tue, 06 Feb 2024 14:10:39 -0800
To: Suman Chakraborty <chakrabortysuman487@gmail.com>
Cc: cygwin@cygwin.com
Subject: Re: MULTIPLE VULNERABILITY REPORT: Multiple DLL Hijacking
 Vulnerability in CygWin setup-x86_64.exe
In-Reply-To: <CAK+bv_tLZMeXWQgKMaS2EZcq9LuBy=3JfYOPz6-Rq+2LqDbqWg@mail.gmail.com>
References: <CAK+bv_tLZMeXWQgKMaS2EZcq9LuBy=3JfYOPz6-Rq+2LqDbqWg@mail.gmail.com>
User-Agent: Roundcube Webmail/1.4.15
Message-ID: <0b8c28c486475cf1868aea678779ee7a@kylheku.com>
Precedence: list
From: Kaz Kylheku via Cygwin <cygwin@cygwin.com>
Reply-To: Kaz Kylheku <kaz@kylheku.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>

On 2024-02-04 21:22, Suman Chakraborty via Cygwin wrote: 
> 1. Executive Summary:
> 
> The vulnerability pertains to not finding
> the profapi.dll, CFGMGR32.dll, edputil.dll,  urlmon.dll, SspiCli.dll,
> Wldp.dll, MPR.dll, ServicingCommon.dll, TextShaping.dll, CRYPTBASE.DLL,
> PROPSYS.dll and insecure loading of dynamic link libraries (DLLs),
> specifically profapi.dll. If exploited, this vulnerability could allow an
> attacker to execute arbitrary code on a victim's machine, potentially
> leading to data breaches, system compromise, and other malicious activities.

By what means is setup.exe probing these DLLs?

I don't see any references to profapi.dll in its source tree
(git grep -i profapi turns up nothing).

If these DLL's being missing doesn't stop the program from running,
doesn't that mean it's just probing for them with LoadLibrary or
LoadLibraryEx explicitly, and then handling the failure gracefully?

Setup itself doesn't use LoadLibrary or LoadLibraryEx.

The MinGW toolchain must be introducing that somehow?

It is curious.

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple