Technical FAQs

Ask a Question

The PowerChute Network Shutdown Windows Installer is susceptible to a DLL hijacking vulnerability

Issue:
The PowerChute Network Shutdown Windows Installer is susceptible to a DLL hijacking vulnerability
 
Product:
PowerChute Network Shutdown v4.1 and earlier
 
Environment:
Microsoft Windows operating systems
 
Cause:
The PowerChute Network Shutdown Windows installer is created using Nullsoft Scriptable Install System (NSIS). Certain versions of NSIS are vulnerable to DLL hijacking (also known as DLL preloading). DLL Hijacking occurs when a malicious DLL is downloaded to the same directory from which the vulnerable NSIS installer will run (e.g. a default web downloads directory). The malicious DLL can then be loaded and executed, potentially with escalated privileges.
 
See Microsoft Security Advisory 2269637 for more information on the vulnerability, and Microsoft Knowledge Base article KB2264107 for information on a Microsoft update created to restrict the locations from which DLL files can be loaded or executed.
 
 
Solution:
This issue has been fixed in the Windows installer for PowerChute Network Shutdown v4.2.
For v4.1 and earlier, please refer to the Suggested Actions section of the Microsoft Security Advisory 2269637
 
Was this helpful?
What can we do to improve the information ?