Microsoft Skype DLL Hijacking

`Hi @ll,  
  
since about two or three years now, Microsoft offers Skype as  
optional update on Windows/Microsoft Update.  
  
JFTR: for Microsoft's euphemistic use of "update" see  
<http://seclists.org/fulldisclosure/2018/Feb/17>  
  
Once installed, Skype uses its own proprietary update mechanism  
instead of Windows/Microsoft Update: Skype periodically runs  
"%ProgramFiles%\Skype\Updater\Updater.exe"  
under the SYSTEM account.  
When an update is available, Updater.exe copies/extracts another  
executable as "%SystemRoot%\Temp\SKY<abcd>.tmp" and executes it  
using the command line  
"%SystemRoot%\Temp\SKY<abcd>.tmp" /QUIET  
  
This executable is vulnerable to DLL hijacking: it loads at least  
UXTheme.dll from its application directory %SystemRoot%\Temp\  
instead from Windows' system directory.  
  
An unprivileged (local) user who is able to place UXTheme.dll or  
any of the other DLLs loaded by the vulnerable executable in  
%SystemRoot%\Temp\ gains escalation of privilege to the SYSTEM  
account.  
  
  
The attack vector is well-known and well-documented as CAPEC-471:  
<https://capec.mitre.org/data/definitions/471.html>  
  
Microsoft published plenty advice/guidance to avoid this beginner's  
error: <https://msdn.microsoft.com/en-us/library/ff919712.aspx>,  
<https://technet.microsoft.com/en-us/library/2269637.aspx>,  
<https://support.microsoft.com/en-us/help/2389418/secure-loading-of-libraries-to-prevent-dll-preloading-attacks>  
and  
<https://blogs.technet.microsoft.com/srd/2014/05/13/load-library-safely/>  
... which their own developers and their QA but seem to ignore!  
  
  
See <https://bugs.chromium.org/p/project-zero/issues/detail?id=440>  
for the same vulnerability in another Microsoft product!  
  
  
stay tuned  
Stefan Kanthak  
  
  
Timeline:  
~~~~~~~~~  
  
2017-09-02 vulnerability report sent to vendor  
  
2017-09-03 reply from vendor: "MSRC case 40550 opened"  
  
2017-09-06 notification from vendor's case manager: "report passed  
to product group for investigation"  
  
2017-10-27 reply from vendor's case manager:  
  
"The engineers provided me with an update on this case.  
They've reviewed the code and were able to reproduce  
the issue, but have determined that the fix will be  
implemented in a newer version of the product rather  
than a security update. The team is planning on shipping  
a newer version of the client, and this current version  
will slowly be deprecated. The installer would need a  
large code revision to prevent DLL injection, but all  
resources have been put toward development of the new  
client."  
  
2018-02-09 report published  
  
  
`