DisplayLink Core Software 8.2.1956 DLL Hijacking

Hi all,

During installation or update of DisplayLink Core Software 8.2.1956 if it
is executed as SYSTEM, as is the case on many companies,binary cl_1956.exe
(Cleaner Application) Hi all,

During installation or update of DisplayLink Core Software 8.2.1956 if it
is executed as SYSTEM, as is the case on many companies,binary cl_1956.exe
(Cleaner Application) is extracted to "%SYSTEMROOT%Temp" and later
executed as SYSTEM using the command line: "C:WindowsTEMPcl_1956.exe"
-min -maxVersion 8.2.1956.0.

This path "%SYSTEMROOT%Temp" is user writable, at least in win10, and
cl_1956.exe is vulnerable to DLL hijack. It loads several dll which are not
known_dll and you can at least hijack wtsapi32.dll to execute code in the
process context.

An unprivileged local user can copy a self compiled dll with name
wtsapi32.dll to %SYSTEMROOT%Temp, and gain SYSTEM privileges when
cl_1956.exe loads and executes it.

*Reference*:
https://capec.mitre.org/data/definitions/471.html

*Timeline*
08/03/2018 Vulnerability report sent to the vendor

12/03/2018 Vendor started internal investigation and assigned track
number 27488

04/04/2018 Vendor released first dev version trying to correct the bug

02/05/2018 Vendor released second dev trying to patch the
vulnerability

14/05/2018 Vendor released "Release Candidate" with bug fixed.
.
29/05/2018 Vendor fixed installed can be downloaded from their
website ( http://www.displaylink.com/downloads/windows )

01/06/2018 Report published
-----
Aleix Sala Bach