The Channel logo


By | Darren Pauli 13th January 2015 05:35

Remember Corel? It's just entered .DLL hell

Hijack hole found in Corel Draw and other doodleware

Local zero day vulnerabilities have been disclosed in Corel applications, potentially affecting more than 100 million users.

The holes were dropped by Marcos Accossatto of Core Security after the doodleware company did not respond to his private disclosure.

Corel has been contacted for comment.

"Given that this is a client-side vulnerability, affected users should avoid opening untrusted files whose extensions are associated with Corel software and contain any of the [affected] DLL files," Accossatto said in an advisory.

"When a file associated with the Corel software is opened, the directory of that document is first used to locate DLLs, which could allow an attacker to execute arbitrary commands by inserting malicious DLLs into the same directory as the document."

At least eight Corel products were affected including DRAW x7, PaintShop Pro x7, CAD 2014, and VideoStudio PRO. Some other Corel products were not tested.

The flaws occurred due to DLL hijacking where an attacker replaced wintab32.dll within the program's directories which would be executed within Corel programs.

Corel was warned 9 December and 2 January of the vulnerabilities and that they would be publicly disclosed if no response was made. It appears not to have responded, hence the disclosure and this story.

Corel claimed to have some 100 million users as of 2012. Plenty of those will be home users who acquired the company's products as bloatware and are now open to exploitation. Again. ®

comment icon Read 24 comments on this article or post a comment alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe