eclipse-platform / eclipse-platform/eclipse.platform

eclipse is vulnerable to a DLL hijacking attack

Open
#168 31 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
165
Forks
174
Avg merge
2d 8h
Merged PRs (30d)
22

Description

When eclipse is executed it tries to load the following two files:
* unixfile_1_0_0.dll
* git.exe

The problem is that those 2 files are not found in the program’s directory and eclipse.exe tries to find them in the Windows system, then the directories listed in the system path, and finally in the directory where eclipse was launched (current directory).

Loading a DLL or EXE from the directory the program was launched (current directory) is considered a security vulnerability.

It would be better if we could do any of the below:

· Fix the code to not load the listed dll and exe from the current directory.

· Include the missing DLL and exe if they are needed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.