News for hackers. Stuff that matters.

A comment on Skype can't fix a nasty security bug without a massive code rewrite. Parent comment

Re:Skype can't fix a nasty security bug without a massive co... by Amezarak on Tuesday February 13, 2018 @09:39AM (#16367402)
> Why is Skype loading random DLLs from user accessible folders?

%SYSTEMROOT%/Temp doesn't seem to be user-readable at all, so I'm having trouble understanding how you write anything there without already having escalated permissions.

[ Parent | on HN ]
Re:Skype can't fix a nasty security bug without a massive co... by enzanki_ars on Tuesday February 13, 2018 @09:59AM (#16367562)
I need to test this later as I only have access to an unprivileged account at the moment, but based on comments online (https://stackoverflow.com/a/11917816), the folder is write only for unprivileged users (FILE_ADD_FILE).
[ Parent | on HN ]
Re:Skype can't fix a nasty security bug without a massive co... by Amezarak on Tuesday February 13, 2018 @10:17AM (#16367722)
You're correct, I was able to write a file without privilege escalation, and then I verified it was there by escalating. Thanks.

If anyone is wondering, it's a little bit tricky to check because without the read permission, Windows Explorer can't see what the permissions are.

[ Parent | on HN ]