drive-by downloads to conduct the well-known and
CAPEC-471: DLL Search Order Hijacking
listed in the
against the well-known and well-documented weaknesses
CWE-426: Untrusted Search Path
CWE-427: Uncontrolled Search Path Element
listed in the
present in almost all executable installers,
self-extracting executable archives
portable applications built for
Windows®, despite the instructions
given in the
Dynamic-Link Library Security
Dynamic-Link Library Search Order,
the Security Advisory
If you miss anything here, have additions, comments, corrections,
criticism or questions, want to give feedback, hints or tipps,
report broken links, bugs, errors, inaccuracies, omissions,
vulnerabilities or weaknesses, …:
don’t hesitate to
and feel free to ask, comment, criticise, flame, notify or report!
Notes: I dislike
even weirder formats too) in email, I prefer to receive plain text.
I also expect to see your full (real) name as sender, not your
Emails in weird formats and without a proper sender name are likely
to be discarded.
I abhor top posts and expect inline quotes in replies.
Terms and Conditions
By using this site, you signify your agreement to these terms and
conditions. If you do not agree to these terms and conditions, do
not use this site!
- The software and the documentation on this site are provided
as is without any warranty, neither express nor
In no event will the author be held liable for any damage(s)
arising from the use of the software or the documentation.
- Permission is granted to use the current version
of the software and the current version of the
documentation solely for personal private and non-commercial
An individuals use of the software or the documentation in his or
her capacity or function as an agent, (independent) contractor,
employee, member or officer of a business, corporation or
organization (commercial or non-commercial) does not qualify as
personal private and non-commercial purpose.
- Without written approval from the author the software or the
documentation must not be used for a business, for
commercial, corporate, governmental, military or organizational
purposes of any kind, or in a commercial, corporate, governmental,
military or organizational environment of any kind.
- Redistribution of the software and the documentation is allowed
only in unmodified form of its current version and
free of charge.
Data Protection Declaration
This web page records no data and sets no
The service provider for *.homepage.t-online.de,
Deutsche Telekom AG,
- records every visitor of this web site in a log file;
IP adresses are
pseudonymised, personal data are not stored.
- sets a
Copyright © 1995–2019 • Stefan Kanthak •