eclipse-platform / eclipse-platform/eclipse.platform
eclipse is vulnerable to a DLL hijacking attack
- Dominant language
- Java
- Stars
- 165
- Forks
- 174
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 22
Description
When eclipse is executed it tries to load the following two files:
* unixfile_1_0_0.dll
* git.exe
The problem is that those 2 files are not found in the program’s directory and eclipse.exe tries to find them in the Windows system, then the directories listed in the system path, and finally in the directory where eclipse was launched (current directory).
Loading a DLL or EXE from the directory the program was launched (current directory) is considered a security vulnerability.
It would be better if we could do any of the below:
· Fix the code to not load the listed dll and exe from the current directory.
· Include the missing DLL and exe if they are needed.
Contributor guide
Assessment
This issue has not been assessed yet.