Binary Planting Vulnerability Fixed in Adobe Illustrator CS5
A security and stability update has been released for Adobe Illustrator CS5, fixing a DLL preloading vulnerability which could be exploited to execute arbitrary code.
Also known as DLL hijacking, binary planting or DLL side loading, this type of vulnerability stems from the use of an insecure search path by some library loading functions. When a DLL is called by a program without specifying its full path, the operating system automatically searches for it in a series of predefined places in order.
The DLL call usually happens when a particular action is performed in the program, such as opening a certain file, and in many cases, the working directory takes precedence in the search path. This type of weakness began being publicly discussed a few months back and hundreds of applications, including some of the most popular ones, were deemed vulnerable.
