1

With a metasploit module and POC code available, there's a growing concern about the DLL path-searching vulnerability in an increasing number of Microsoft and 3rd party applications. It appears that ensuring SafeDLLSearchMode is enabled mitigates the vlunerability, and I would like to enforce this on a network via Group Policy. While it's enabled by default in XP SP2+ and requires a registry edit to disable, I'd like to find an ADM file (or perhaps there's an existing policy setting I'm missing) that will let me ensure it remains active.

Does anyone know if anything like this is out there, or could anyone suggest how such an ADM file should look? The key in question is: 

HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode

With a value of 1 for enabled and 0 for disabled.

Improve this question
4
  • 1
    Do you have Client-Side Preferences available on your workstations?
    – jscott
    Aug 25, 2010 at 17:45
  • Our Windows Servers are all 2003 and 2003 R2. My understanding is you need at least one 2008 server to administer Client-Side Preferences. Sounds like a pretty useful feature, though.
    – nedm
    Aug 25, 2010 at 18:01
  • 1
    No, you don't need 2008 Server. You will need RSAT on Vista or Windows 7 to manage the CSPs in Group Policy though. Your clients will also need the CSP extension installed.
    – jscott
    Aug 25, 2010 at 18:06
  • That's great, thanks for the info -- will look into this.
    – nedm
    Aug 25, 2010 at 18:10

1 Answer 1

Reset to default
2

Here is an ADM you can use to apply this preference. If you had Client-Side Preferences you could better manage this setting.

CLASS MACHINE
CATEGORY "Extras"
  CATEGORY "Software Settings"
    CATEGORY "Safe DLL Search Mode"
        POLICY "Safe DLL Search Mode"
          KEYNAME "System\CurrentControlSet\Control\Session Manager"
              EXPLAIN "Enable safe DLL search mode."
          VALUENAME "SafeDllSearchMode"
            VALUEON  NUMERIC 1
            VALUEOFF NUMERIC 0
        END POLICY
    END CATEGORY
  END CATEGORY
END CATEGORY

You can also change this value with a simple script:

REG ADD "HKLM\System\CurrentControlSet\Control\Session Manager" /v "SafeDllSearchMode" /t REG_DWORD /d "1" /f
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .