{"id":12934,"date":"2018-07-29T14:19:11","date_gmt":"2018-07-29T22:19:11","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/07\/29\/news-6701\/"},"modified":"2018-07-29T14:19:11","modified_gmt":"2018-07-29T22:19:11","slug":"news-6701","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/07\/29\/news-6701\/","title":{"rendered":"SSD Advisory \u2013 LINE Corporation URI Handlers Remote Commands Execution"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Sun, 29 Jul 2018 05:10:59 +0000<\/strong><\/p>\n

\n
\n

Vulnerabilities Summary<\/strong>
LINE for Windows provided by LINE Corporation specifies the path to read DLL when launching software. A user clicking on a specially crafted link, can use this vulnerability to cause the user to insecurely load an arbitrary DLL which can be used to cause arbitrary code execution.<\/p>\n

Vendor Response<\/strong>
“We released version 5.8.0 of the modified version LINE PC version (Windows version) on May 31, 2018, and we have automatically updated for all users. The update will be applied automatically on the system side when using the product.\u00a0Also, when installing the LINE PC version (Windows version) from now on please use the latest installer”.<\/p>\n

CVE<\/strong>
CVE-2018-0609<\/p>\n

Credit<\/strong>
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.
<\/span>
Affected systems<\/strong>
LINE for Windows before version 5.8.0<\/p>\n

Vulnerability Details<\/strong>
When processing a ‘line:’ or ‘lineb:’ URI’s it is possible to pass arbitrary command line parameters to LINE.exe, given that the application does not properly parse the mentioned URI ‘scheme:’. In addition, the ‘-platformpluginpath’ parameter supports network share paths. Using this parameter an attacker can cause the application to remotely load a Qt (https:\/\/www.qt.io\/) DLL library from the network share, found inside the sub-path \/imageformats.<\/p>\n

PoC<\/strong><\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n

XHTML<\/span><\/div>\n<\/div>\n

<\/div>\n