Menu
Vulnerabilities in several Corel programs allow attackers to execute malicious code

Vulnerabilities in several Corel programs allow attackers to execute malicious code

Malicious DLLs will be executed if stored in the same directory as media files opened with the affected programs, researchers said

Several photo, video and other media editing programs from software maker Corel contain DLL hijacking vulnerabilities that could allow attackers to execute malicious code on users' computers.

According to vulnerability research firm Core Security, when opening a media file associated with one of the vulnerable Corel products, the product will also load a specifically named DLL (Dynamic Link Library) file into memory if it's located in the same directory as the opened media file.

DLL files contain executable code so they can be used to install malware on computers.

The vulnerable products are CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, CorelCAD 2014, Corel Painter 2015, Corel PDF Fusion, Corel VideoStudio PRO X7 and Corel FastFlick, the Core Security researchers said in an advisory published Monday. Other versions might be affected too, but they haven't been checked, they said.

In order to exploit these client-side vulnerabilities, an attacker could, for example, send a ZIP archive to a Corel user containing a media file associated with vulnerable Corel software and a specifically named malicious DLL. When the user opened the legitimate Corel file, the DLL would run as well.

In a corporate environment an attacker with access to a file sharing server could place the rogue DLL file alongside legitimate Corel files on an existing network share to infect workstations that use those files.

The specific name that the rogue DLL needs to have varies depending on the targeted Corel program. For example, wintab32.dll will work for CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015 and Corel PDF Fusion, according to the Core researchers. For CorelCAD 2014, the file would have to be named FxManagedCommands_3.08_9.tx or TD_Mgd_3.08_9.dll.

DLL hijacking vulnerabilities, which result from an insecure DLL search path declaration in software programs, are not uncommon. The Stuxnet sabotage malware, which was used to attack Iran's nuclear program, exploited a DLL hijacking vulnerability in Siemens' SIMATIC STEP 7 and SIMATIC PCS 7 industrial automation software, among other flaws.

On its site, Corel claims that its software has over 100 million active users in over 75 countries. Many of those are probably businesses that use photo and video editing or computer-aided design (CAD) software in their operations.

Core Security claims that it contacted Corel about these vulnerabilities on Dec. 9, but that the company did not respond. As a result, it decided to make information about the flaws public.

"Corel is reviewing its products on a case-by-case basis to safeguard dynamic loading of DLL files, which is a common vulnerability in many Windows applications," said Jessica Gould, senior communications manager for Corel, in an emailed statement Tuesday.

"Corel makes frequent updates to our applications and these changes have been made a priority for the next update of any affected Corel product. We would like to assure our users that we are not aware of any exploits of this issue with our software."

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags corelCore SecuritysecurityExploits / vulnerabilitiesmalware

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments