Remember Corel? It's just entered .DLL hell

Local zero day vulnerabilities have been disclosed in Corel applications, potentially affecting more than 100 million users.

The holes were dropped by Marcos Accossatto of Core Security after the doodleware company did not respond to his private disclosure.

Corel has been contacted for comment.

"Given that this is a client-side vulnerability, affected users should avoid opening untrusted files whose extensions are associated with Corel software and contain any of the [affected] DLL files," Accossatto said in an advisory.

"When a file associated with the Corel software is opened, the directory of that document is first used to locate DLLs, which could allow an attacker to execute arbitrary commands by inserting malicious DLLs into the same directory as the document."

At least eight Corel products were affected including DRAW x7, PaintShop Pro x7, CAD 2014, and VideoStudio PRO. Some other Corel products were not tested.

The flaws occurred due to DLL hijacking where an attacker replaced wintab32.dll within the program's directories which would be executed within Corel programs.

Corel was warned 9 December and 2 January of the vulnerabilities and that they would be publicly disclosed if no response was made. It appears not to have responded, hence the disclosure and this story.

Corel claimed to have some 100 million users as of 2012. Plenty of those will be home users who acquired the company's products as bloatware and are now open to exploitation. Again. ®