Altera High Level Synthesis Compiler Uncontrolled Search Path Element Vulnerability Allowing Search Order Hijacking

A vulnerability allowing search order hijacking has been identified in the Altera High Level Synthesis Compiler for Windows, affecting versions 19.1 prior to 24.3. This uncontrolled search path element vulnerability can lead to a DLL planting issue, where malicious DLLs could be loaded by the application.

Impact

Exploitation of this vulnerability could allow for unauthorized DLLs to be loaded, potentially leading to arbitrary code execution.

Remediation

Altera recommends replacing the build.bat file in the affected directory with a version available through their official channels. Additionally, write access to the 'C:\quartus\bin64' directory should be restricted to system administrators only.