DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 24C413858C60
MIME-Version: 1.0
Date: Thu, 08 Feb 2024 18:17:39 -0800
To: Jon Turney <jon.turney@dronecode.org.uk>
Cc: cygwin-announce@cygwin.com, The Cygwin Mailing List <cygwin@cygwin.com>
Subject: Re: Updated: setup (2.930)
In-Reply-To: <6a25c776-98bb-4240-8a57-7081324c5a05@dronecode.org.uk>
References: <6a25c776-98bb-4240-8a57-7081324c5a05@dronecode.org.uk>
User-Agent: Roundcube Webmail/1.4.15
Message-ID: <23db00778577ab0853fe1026befb9fe8@kylheku.com>
Precedence: list
From: Kaz Kylheku via Cygwin <cygwin@cygwin.com>
Reply-To: Kaz Kylheku <kaz@kylheku.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>

On 2024-02-07 11:57, Jon Turney via Cygwin wrote:
> A new version of Setup (2.930) has been uploaded to:
> 
>  https://cygwin.com/setup-x86_64.exe  (64 bit version)
>  https://cygwin.com/setup-x86.exe     (32 bit version)
> 
> Changes compared to 2.929:
> 
> - Add some hardening against "DLL hijacking" attacks (Thanks to Corinna Vinschen for doing all the thinking involved)

Is this because of the report submitted by Suman Chakraborty?

I didn't see any public response confirming that there is any problem,and that that action would be taken.

I see the commit: https://cygwin.com/cgit/cygwin-apps/setup/commit/?id=0122154811bacdd7dc042cff0c80bb0a36af360c

I'm curious, what improvement arises out of looking up the SetDefaultDllDirectories
function dynamically in kernel32.dll?

Is it the case that malicious software can interpose itself somehow such that
the statically linked SetDefaultDllDirectories call goes elsewhere other than
kernel32.dll, which we can thwart by asking for the genuine article in kernel32.dll?

(If this fixes the problem for Suman, he has some malware or antivirus crap on his PC.)

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple