3 ms·

I need to test this later as I only have access to an unprivileged account at the moment, but based on comments online (https://stackoverflow.com/a/11917816 htt

I need to test this later as I only have access to an unprivileged account at the moment, but based on comments online (https://stackoverflow.com/a/11917816 https://stackoverflow.com/a/11917816), C:\Windows\Temp (%systemroot%\Temp redirects here, and is the folder Skype accesses from, is write only for unprivileged users (FILE_ADD_FILE). Preliminary testing shows that I was able to write there with out any problem. No way for me to read it at the moment though... Edit: As noted by another user here, yes, it is writeable. https://news.ycombinator.com/item?id=16367722 https://news.ycombinator.com/item?id=16367722

user5454 9y ago
You're right. It is possible to write a file but not to list or access any other files. So it is a security bug. You could "fix" it yourself though, by using a privileged account and copy any DLLs loaded by the Skype updater into the directory.. An unprivileged user would not be able to overwrite the files.
- enzanki_ars 9y ago
  Not sure, but based on the image in the stackoverflow link, it states that it has FILE_ADD_FILE, which translates in the GUI to “Create files / write data,” which I would assume means that overwrites are possible. Don’t trust my word on that though as I am no expert. Will try that a bit later and see what happens.
  - user5994461 9y ago
    Given the name, you should assume that it specifically prevent from overwriting files. The windows filesystem has more than a dozen specific permissions, similar to advanced acl on Linux, that allows very fine grained permissions. This allows to have shared folders where users can do anything, except delete the directory itself or modify files created by other users.
  - amag 9y ago
    You still can't overwrite files created by privileged users unless explicitly allowed to do so by the creator of the file. If you could, a lot more things would be broken in Windows.

user5454 9y ago

You're right. It is possible to write a file but not to list or access any other files. So it is a security bug. You could "fix" it yourself though, by using a privileged account and copy any DLLs loaded by the Skype updater into the directory.. An unprivileged user would not be able to overwrite the files.

enzanki_ars 9y ago
Not sure, but based on the image in the stackoverflow link, it states that it has FILE_ADD_FILE, which translates in the GUI to “Create files / write data,” which I would assume means that overwrites are possible. Don’t trust my word on that though as I am no expert. Will try that a bit later and see what happens.
- user5994461 9y ago
  Given the name, you should assume that it specifically prevent from overwriting files. The windows filesystem has more than a dozen specific permissions, similar to advanced acl on Linux, that allows very fine grained permissions. This allows to have shared folders where users can do anything, except delete the directory itself or modify files created by other users.
- amag 9y ago
  You still can't overwrite files created by privileged users unless explicitly allowed to do so by the creator of the file. If you could, a lot more things would be broken in Windows.