Windows compatibility mode resurfaces old flaws

Microsoft is warning users that they will resurface old security issues if they apply the compatibility mode feature to applications requiring past versions of Windows to run.

Compatibility mode allows programs written for older versions of Windows to operate in more modern variants.

Windows 95 coding veteran Raymond Chen said the company had received a vulnerability report that found an application would become vulnerable to Windows 2000 security issues if the compability mode for that version of the operating system is applied to the app.

"Well, yeah. Because that's what you asked for," Chen wrote.

"If you set a program to run in Windows 2000 compatibility mode, then one of the things that happens is that the DLL [dynamic link library] loading follows the Windows 2000 rules, and Windows 2000 predates the Safe­Dll­Search­Mode setting, so they always follow the "Safe­Dll­Search­Mode is disabled" rules.

"This is intentional, because one of the reasons the program was put into Windows 2000 compatibility mode is that it relies on the Windows 2000 algorithm for DLL loading. In other words, the program relies on bug-for-bug compatibility, and the Windows 2000 compatibility does its best to oblige."

Compatibility shims should be applied only to address compatibility issues - "not as something you run around applying to anything you see, because some compatibility shims weaken security for compatibility reasons", Chen warned.

If software requires Windows 2000 to run, the vendor is unlikely to ever address their product's inherent security problems given it has had 15 years to do so, he argued.

Similarly, users who manually set programs to run in compatibility mode should also not be surprised at the security issues this causes, Chen said.

Using compatibility mode does not alter security boundaries between programs and the rest of the Windows operating system, affecting only the application itself. 

A full system compromise requires administrator privileges to modify the Windows compatibility database or edit system shortcuts, in which case "you're already on the other side of the airtight hatchway," Chen said.