| 标题 | Iobit Driver Booster 11.0.0.0 Uncontrolled Search Path |
|---|
| 描述 | A BPL sideloading vulnerability has been discovered in Driver Booster Version x.x.x.x
When a user open the RttHlp.exe file (jdekl.exe renamed by the threat actor), the application will load the following BPL from the same directory:
VCL120.BPL
Using a crafted BPL, it is possible to execute arbitrary code in the context of the current logged in user.
Currently there are cybercriminals who are taking advantage of this vulnerabilty to install malware.
https://cyble.com/blog/uac-0184-abuses-python-in-dll-sideloading-for-xworm-distribution/
SHA256: 8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473 |
|---|
| 来源 | ⚠️ https://www.helpnetsecurity.com/2024/06/26/malware-bpl-sideloading/ |
|---|
| 用户 | daniel.soriano (UID 72214) |
|---|
| 提交 | 2024-07-21 08時53分 (2 年前) |
|---|
| 管理 | 2024-07-31 14時06分 (10 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 273248 [IObit Driver Booster 11.0.0.0 BPL VCL120.BPL 权限提升] |
|---|
| 积分 | 20 |
|---|