CVE-2014-8394 – Corel Software DLL Hijacking

https://notcve.org/view.php?id=CVE-2014-8394

Multiple untrusted search path vulnerabilities in Corel CAD 2014 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) FxManagedCommands_3.08_9.tx or (2) TD_Mgd_3.08_9.dll file in the current working directory. Múltiples vulnerabilidades de ruta de búsqueda no confiable en Corel CAD 2014 permiten a usuarios locales ejecutar código arbitrario y realizar ataques del secuestro de DLL a través de un fichero (1) FxManagedCommands_3.08_9.tx o (2) TD_Mgd_3.08_9.dll troyano en el directorio de trabajos actuales. Various Corel software suffers from a DLL hijacking vulnerability. When a file associated with the Corel software is opened, the directory of that document is first used to locate DLLs, which could allow an attacker to execute arbitrary commands by inserting malicious DLLs into the same directory as the document. • http://seclists.org/fulldisclosure/2015/Jan/33 http://www.coresecurity.com/advisories/corel-software-dll-hijacking http://www.securityfocus.com/archive/1/534452/100/0/threaded http://www.securityfocus.com/bid/72004 •