Menu
Vulnerabilities in several Corel programs allow attackers to execute malicious code

Vulnerabilities in several Corel programs allow attackers to execute malicious code

Malicious DLLs will be executed if stored in the same directory as media files opened with the affected programs, researchers said

Several photo, video and other media editing programs from software maker Corel contain DLL hijacking vulnerabilities that could allow attackers to execute malicious code on users' computers.

According to vulnerability research firm Core Security, when opening a media file associated with one of the vulnerable Corel products, the product will also load a specifically named DLL (Dynamic Link Library) file into memory if it's located in the same directory as the opened media file.

DLL files contain executable code so they can be used to install malware on computers.

The vulnerable products are CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, CorelCAD 2014, Corel Painter 2015, Corel PDF Fusion, Corel VideoStudio PRO X7 and Corel FastFlick, the Core Security researchers said in an advisory published Monday. Other versions might be affected too, but they haven't been checked, they said.

In order to exploit these client-side vulnerabilities, an attacker could, for example, send a ZIP archive to a Corel user containing a media file associated with vulnerable Corel software and a specifically named malicious DLL. When the user opened the legitimate Corel file, the DLL would run as well.

In a corporate environment an attacker with access to a file sharing server could place the rogue DLL file alongside legitimate Corel files on an existing network share to infect workstations that use those files.

The specific name that the rogue DLL needs to have varies depending on the targeted Corel program. For example, wintab32.dll will work for CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015 and Corel PDF Fusion, according to the Core researchers. For CorelCAD 2014, the file would have to be named FxManagedCommands_3.08_9.tx or TD_Mgd_3.08_9.dll.

DLL hijacking vulnerabilities, which result from an insecure DLL search path declaration in software programs, are not uncommon. The Stuxnet sabotage malware, which was used to attack Iran's nuclear program, exploited a DLL hijacking vulnerability in Siemens' SIMATIC STEP 7 and SIMATIC PCS 7 industrial automation software, among other flaws.

On its site, Corel claims that its software has over 100 million active users in over 75 countries. Many of those are probably businesses that use photo and video editing or computer-aided design (CAD) software in their operations.

Core Security claims that it contacted Corel about these vulnerabilities on Dec. 9, but that the company did not respond. As a result, it decided to make information about the flaws public.

"Corel is reviewing its products on a case-by-case basis to safeguard dynamic loading of DLL files, which is a common vulnerability in many Windows applications," said Jessica Gould, senior communications manager for Corel, in an emailed statement Tuesday.

"Corel makes frequent updates to our applications and these changes have been made a priority for the next update of any affected Corel product. We would like to assure our users that we are not aware of any exploits of this issue with our software."


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwarecorelExploits / vulnerabilitiesCore Security

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments