CVE-2018-6700 in True Key
Summary
by MITRE
DLL Search Order Hijacking vulnerability in Microsoft Windows Client in McAfee True Key (TK) before 5.1.165 allows local users to execute arbitrary code via specially crafted malware.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/27/2020
The CVE-2018-6700 vulnerability represents a critical DLL search order hijacking flaw that affected Microsoft Windows clients running McAfee True Key versions prior to 5.1.165. This vulnerability exploits the fundamental Windows dynamic link library loading mechanism where the operating system searches for required DLL files in a specific order. When a legitimate application or service fails to specify the full path to a required DLL, Windows follows its default search sequence which includes the current working directory before checking system directories. This behavior creates a potential attack vector where malicious actors can place specially crafted malicious DLL files in directories that Windows checks before the legitimate system locations, effectively hijacking the application's execution flow.
The technical implementation of this vulnerability stems from improper DLL loading practices within the McAfee True Key client software. When the application attempts to load certain dependencies, it relies on the system's default search order rather than explicitly specifying full paths to system DLLs. This flaw allows local attackers to place malicious DLL files in the application's working directory or other locations in the search order, causing the system to load the attacker-controlled code instead of the legitimate Microsoft-provided DLLs. The vulnerability specifically impacts Windows client operating systems and affects the McAfee True Key authentication client that manages user credentials and security tokens. The flaw enables privilege escalation scenarios where local users can execute arbitrary code with the privileges of the target application, potentially leading to full system compromise.
The operational impact of CVE-2018-6700 extends beyond simple code execution as it represents a sophisticated attack vector that leverages the trust relationships inherent in Windows application loading mechanisms. Attackers can exploit this vulnerability to bypass security controls and gain unauthorized access to systems, particularly in environments where McAfee True Key is deployed for credential management. The vulnerability is particularly concerning because it requires no elevated privileges to exploit, making it accessible to any local user who can place files in the application's search path. This characteristic aligns with the ATT&CK framework's technique T1059.001 for command and script interpreter execution and T1068 for exploit for privilege escalation. The vulnerability also relates to CWE-426, which describes the insecure loading of dynamic libraries, and CWE-78, which addresses OS command injection vulnerabilities that can be leveraged through DLL hijacking attacks.
Mitigation strategies for CVE-2018-6700 primarily focus on updating to McAfee True Key version 5.1.165 or later, which contains the necessary patches to address the insecure DLL loading practices. Organizations should also implement additional security controls such as enabling Windows Defender Application Control or AppLocker policies to restrict DLL loading from untrusted locations. System administrators should conduct comprehensive vulnerability assessments to identify all instances of the affected software and ensure proper patch management procedures are in place. The mitigation approach aligns with the principle of least privilege and follows security best practices outlined in NIST SP 800-171 for protecting controlled unclassified information in non-federal systems and organizations. Additionally, implementing proper directory permissions and monitoring for unauthorized DLL placement activities can provide additional layers of defense against exploitation attempts. Organizations should also consider deploying endpoint detection and response solutions that can identify suspicious DLL loading patterns and alert on potential hijacking attempts.