Travel 2 Browser Remote Code Execution Vulnerability and repair solution

Brief description: The compatibility of library files in IE6, 7, and 8 scenarios is not considered in browser 2, which leads to a low-level DLL library loading error and eventually leads to a serious Remote Code Execution Vulnerability.
Detailed Description: browser 2 loads ieframe in an absolute path. dll, while IE6 does not have ieframe. dll, set ieframe. dll and HTML webpage files are stored in the same directory. When the browser opens the webpage, ieframe is injected. dll.

Proof of vulnerability: test environment: IE6 + xp sp3
Browse Web files in a UNC path, such:

 

Solution: loadlibary:
1. Program path
2. system32
3. system
4. windows
5. Program Execution path
6. PATH Environment Variables

The DLL hijacking vulnerability may occur when files are imported to the database through the relative path.

The vulnerability software accesses the associated files through a UNC path such as webdav in a non-database file environment. After the vulnerability software reaches 5th paths, the remote DLL library will be loaded based on the Program Execution path!

Free tutorial on security knowledge, and finally how to make up, you know.