Skype update installer found to be susceptible to DLL hijacking, potentially giving system-level privileges; Microsoft says fix will come when app is rewritten
so it won't bother. http://www.zdnet.com/...
Context & Ripple Effects
Microsoft's response here is unusual: rather than patching, it told researchers a fix would arrive only when the Skype app is rewritten, effectively accepting the risk on its own timeline. Two days after this report, The Register noted Microsoft had already shipped the fix in October 2017's version 8 release — meaning the exposure is concentrated in Skype versions 7.40 and below, where the vulnerable installer still ships.
That framing turns this from a single bug into a legacy-user problem: anyone who hasn't been migrated to version 8 is running an installer that can hand attackers system-level privileges via DLL hijacking.
First-order effects
- Users still on Skype 7.40 or older face a live privilege-escalation path through the update installer, while Microsoft's stated position leaves them without a targeted patch for their version.
- Security teams managing Skype deployments must either force-migrate users to version 8 or treat every install/upgrade event as a potential local-attack window.
Second-order effects
- Microsoft's 'fix comes with the rewrite' stance sets a precedent other desktop vendors can cite for deferring patches on legacy code paths — and an invitation for researchers to keep probing update mechanisms, a line of work that later surfaced in Zoom's Mac auto-update flaw giving root access.
- Rival communication apps gain a security talking point against Skype precisely among enterprise holdouts most likely to be running old versions.
Third-order effects
- If vendors routinely tie security fixes to full rewrites rather than backports, legacy-version user bases become structurally unpatchable — pushing the industry toward forced-upgrade models and shortening how long old clients stay supported.
- Update and installer code, long treated as plumbing, consolidates into a first-class attack surface that privilege-escalation research like the Windows zero-day Kaspersky found espionage groups exploiting keeps validating.
The trend: Desktop app security is shifting from patch-per-bug toward rewrite-or-deprecate cycles, leaving legacy client versions as the residual attack surface.