As normal user, if you open the
Edit Environment Variable setting in Windows, you will get this:
As you can see, the
%path% variable that available for an user is a combination of
%path% set globally as
System variables and
%path% set locally for each user
User variables for username.
Consider the following situation:
If the user adds a path to his
%path%, for example he adds
C:\mybin to his
%path% to run his program
C:\mybin\myapp.exe. But if he accidentally runs an unwanted program (as normal user) that change his user
%path% (this can be done without administrator rights) to a different directory, for example
%temp%\fake which contain the fake app but same name
myapp.exe and delete the path
C:\mybin from his variable, then he open Command Prompt as Administrator to run his
myapp.exe, he will get the fake app
myapp.exe run as administrator.
So my question is: is this called a vulnerability and will it be practical for viruses to do this?
I also find that some installers (which are run as administrator), extract their contents to
%temp% and run some of these, so is they vulnerable too?