title: Cisco Directory Connector Search Order Hijacking Vulnerability
description: A vulnerability in the search path processing of Cisco Directory Connector could allow an authenticated, local attacker to load a binary of their choosing. The vulnerability is due to uncontrolled search path elements. An attacker could exploit this vulnerability by placing a binary of their choosing earlier in the search path utilized by Cisco Directory Connector to locate and load required resources.
problem types: CWE-427
affected:
{
product: Cisco Directory Connector
vendor: Cisco
versions:
status: affected, version: 2.2
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
version: 3.0
]
exploits: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
workarounds: To ensure that supporting dynamic link libraries (DLLs) are loaded from system locations prior to the user's current working directory, an administrator can verify SafeDLLSearchMode is enabled in the Windows Registry. This process is outlined in Deployment Guide for Cisco Directory Connector. Warning: Incorrectly modifying the system registry of a Microsoft Windows-based device may cause serious problems. Neither Cisco nor Microsoft can guarantee that problems that may result from improper registry modification, either from applying registry changes via a .reg file or by using the Registry Editor, can be resolved. Modify the registry of a system at the user's own risk.