Bugtraq: RE: Round One: "DLL Proxy" Attack Easily Hijacks SSL from Interne t Explorer

["Johnson, Jeff FOR:EX" <Jeff.S.Johnson () gems1 gov bc ca>]

> Yeah, but won't this break a lot of programs that install their DLL's 
> in their own directories by design, so that they may be installed by 
> users without administrative privileges on older versions of Windows? 
The change still allows use of DLLs in the application directory; it just
puts the System and Windows directories ahead of the 'current directory' in
the search order. (The Current directory and application EXE directory can
be different).

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/bas
e/loadlibraryex.asp

Actually, looking at that article, even with SafeDllSearchMode ON, it looks
like the application directory is still checked first and only the order of
the 'current directory' is changed to be after the Windows and System
directories. You'd have to test this to see what was really happening, to be
sure.

Jeff Johnson
Technical Development Analyst, MoF IMG
Jeff.S.Johnson () gems1 gov bc ca
(250) 356-6968