806814 - We should call SetDllDirectory("") in our NSIS installers as a precaution

Status: RESOLVED FIXED

(Thunderbird :: Installer, defect)

Description

[Mark Banner (:standard8)]

+++ This bug was initially created as a clone of Bug #801853 +++

There is no known DLL injection call that would be fixed by calling SetDllDirectory(""), but it would be good practice to do so. 

SetDllDirectory("") helps only with LoadLibrary calls, so this isn't a blanket fix for all DLL injection attacks to the installer.  In particular it doesn't help with implicitly linked DLLs. 

Leaving as security-sensitive for now in case there is a problem I don't know about.

See also bug 792106

Comment 1

[Mark Banner (:standard8)]

Attachment: The fix

Directly ported from bug 801853.

Robert, would you mind doing the review of this as you reviewed that patch?

Comment 2

[Mark Banner (:standard8)]

Comment on attachment 735080 [details] [diff] [review]
The fix

[Triage Comment]
As Thunderbird trunk is currently closed, I've landed this directly on beta as we're just about to build our one and only beta for this cycle. I'll leave open to land on trunk & aurora.

Comment 3

[Mark Banner (:standard8)]

https://hg.mozilla.org/releases/comm-beta/rev/9277665dfff3

Comment 4

[Mark Banner (:standard8)]

https://hg.mozilla.org/comm-central/rev/10d2778de689
https://hg.mozilla.org/releases/comm-aurora/rev/9c12a1bd9692

Comment 5

[Mark Banner (:standard8)]

Comment on attachment 735080 [details] [diff] [review]
The fix

[Triage Comment]
a=me for ESR (although this is only moderate, 17 is our main releases at the moment).

Comment 6

[Mark Banner (:standard8)]

https://hg.mozilla.org/releases/comm-esr17/rev/f1a6816eb13a