3 ms·
If that were all there is to it, would this not be an issue for all Windows applications, not just Skype? Is it just Skype that puts the current working directo
by mannykannot 9y ago
If that were all there is to it, would this not be an issue for all Windows applications, not just Skype? Is it just Skype that puts the current working directory in the list, or at least in a position where it can be used to preempt the loading of the correct DLL?
The link you provide as an example suggests that this sort of thing might be done to facilitate testing, but again, that doesn't seem to be a compelling reason for not fixing it now - 'ship what you test' is a good principle, but it does not preempt 'fix known security holes.'
- Svip 9y agoWell, I guess not all Windows applications are run as the SYSTEM account, but the Skype SKY-tmp is? I'd assume, at least, that programs intended to run as the SYSTEM account does a better job of loading DLLs from secure locations.
- notriddle 9y agoIn other words, the Linux equivalent would be a setuid executable that doesn't properly ignore LD_PRELOAD_PATH.
- user5994461 9y agoWell, the system executable should not be run as root from /tmp obviously.
- rhodysurf 9y agoIts an issue with all windows applications but not all windows applications have the same elevated permissions that skype seems to
- mherdeg 9y agoIt is an issue for all Windows applications. There was a month when 50%+ of the traffic on full-disclosure@ was just one person repeatedly announcing newly discovered problems with various Windows software that all involved search-path problems ("DLL hijacking" or related issues). There's at least one author who is super keen on using the phrase "binary planting" to refer to a similar class of attacks.