7

I have several clients that are having trouble logging into vendor's web service. When talking to the vendor about the issue, they told me to set them up with Chrome running in Windows XP compatibility mode. This is how they want the client to change the compatibility settings:

Look here!

I have some reservations about this fix workaround, given that Microsoft does not support Windows XP anymore (unless you pay for it). Can running a browser in Windows compatibility mode be a security issue?

3

There are a few things that are enabled when setting compatibility mode, such as shimming.

There are also other changes that may impact on security:-

There have also been some other changes from Windows version to Windows version. In older versions for example, if a programm [sic] loaded a DLL, the search path for the DLL also included the current directory. This is a security issue, so newer versions of Windows by default don't search in the current directory. With the proper shim you can simulate the old behaviour.

This would normally only be a security issue for the local machine if an unprivileged user had permission to copy a malicious DLL to the Chrome installation folder it could be loaded in place of the normally loaded DLL and be executed when a privileged user next ran Chrome (although UAC would still mitigate the damage as this will still apply in compatibility mode).

The attacker would of course need access to the machine, and would need a perfect storm of misconfiguration to succeed. There are no vulnerabilities in the compatibility mode changes that I know of that would enable an attack on the client to succeed from the web where it would not normally succeed without compatibility mode.

0

absolutely not!

it's only some kind of emulation that fool the application with older OS environment.

companies don't ship previously fixed vulnerabilities in new software to users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.