------------------------------------------------------------------------
Microsoft Visio multiple DLL side loading vulnerabilities
------------------------------------------------------------------------
Yorick Koster, August 2015

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
Multiple DLL side loading vulnerabilities were found in Microsoft Visio.
These issues can be exploited by loading various Visio COM components as
an embedded OLE object. When instantiating a vulnerable object Windows
will try to load the DLL msoutls.dll from the current working directory.
If an attacker convinces the user to open a specially crafted (Office)
document from a directory also containing the attacker's DLL file, it is
possible to execute arbitrary code with the privileges of the target
user. This can potentially result in the attacker taking complete
control of the affected system.

------------------------------------------------------------------------
See also
------------------------------------------------------------------------
- CVE-2016-3235
- MS16-070: Security Update for Microsoft Office (3163610)

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully verified on Windows 7 + Visio 2010.
Microsoft reports that this issue also affects Microsoft Visio 2007,
Microsoft Visio 2013, and Microsoft Visio 2016.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Microsoft released MS16-070 that fixes this vulnerability.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20150804/microsoft_visio_multiple_dll_side_loading_vulnerabilities.html