Vendor dan Produk

CPE, singkatan dari Common Platform Enumeration, adalah skema standar untuk penamaan perangkat keras, perangkat lunak, dan sistem operasi. CPE menyediakan skema penamaan terstruktur untuk mengidentifikasi dan mengklasifikasikan sistem teknologi informasi, platform, dan paket secara unik berdasarkan atribut tertentu seperti vendor, nama produk, versi, pembaruan, edisi, dan bahasa.

Deskripsi CAPEC

An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explicit about the characteristics of the DLL to be loaded, they can be vulnerable to side-loading.

Informasi CAPEC

Prasyarat

The target must fail to verify the integrity of the DLL before using them.

Keahlian yang Diperlukan

Trick the operating system in loading a malicious DLL instead of a legitimate DLL.

Mitigasi

Prevent unknown DLLs from loading through using an allowlist policy.
Patch installed applications as soon as new updates become available.
Properly restrict the location of the software being used.
Use of sxstrace.exe on Windows as well as manual inspection of the manifests.
Require code signing and avoid using relative paths for resources.

Kelemahan Terkait

CWE-ID	Nama Kelemahan
CWE-706	Use of Incorrectly-Resolved Name or Reference The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Referensi

REF-501

DLL SIDE-LOADING: A Thorn in the Side of the Anti-Virus Industry
Stewart A..
https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf

Pengajuan

Nama	Organisasi	Tanggal	Tanggal rilis
CAPEC Content Team	The MITRE Corporation	2018-07-31 +00:00

Modifikasi

Nama	Organisasi	Tanggal	Komentar
CAPEC Content Team	The MITRE Corporation	2019-04-04 +00:00	Updated Taxonomy_Mappings
CAPEC Content Team	The MITRE Corporation	2020-07-30 +00:00	Updated Mitigations, Taxonomy_Mappings

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.

Detail CAPEC-641

CAPEC-641