Fyodor <fyo...@insecure.org> wrote: >> nmap <= 5.21 is vulnerable to Windows DLL Hijacking Vulnerability. > > Nmap is not vulnerable. DLL hijacking works because of an unfortunate > interaction between apps which register Windows file extensions and > the default Windows DLL search path used for those apps. Nmap does > not, and never has, registered any Windows file extensions. So it > isn't vulnerable to this issue.
The "easy demo" is with clicks, which needs registration of extensions. The "real thing" is a DLL in the current directory. Unless you always use "cd path/to/nmap; ./nmap" to start, you are vulnerable: most people would set their %PATH% to include the right thing for easy nmap. Cheers, Paul Paul Szabo p...@maths.usyd.edu.au http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of Sydney Australia _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
