Bugtraq mailing list archives
Re: Default Screen Saver Vulnerability in Microsoft Windows
From: "Jason V. Miller" <jmiller () securityfocus com>
Date: Wed, 24 May 2006 16:52:13 -0600
On Wed, May 24, 2006 at 08:52:18PM +0200, Ansgar -59cobalt- Wiechers wrote:
To be able to write to this registry key or to %SystemRoot%\system32 administrative or system privileges are required. Why do you believe this to be a vulnerability?
To the best of my recollection, this is actually an issue on NT4. In the event that you opt not to install the screen savers during installation, a normal user is able to create ``logon.scr'' in ``%systemroot%\system32'', as the default permissions on this directory include Everyone:Change. This facilitates local privilege escalation from a normal user to LocalSystem. At least, that's how I remember it working. I think I mentioned this to Microsoft around 5 years ago, but they didn't consider it to be a problem. J. -- Jason V. Miller, Threat Analyst Symantec, Inc. - www.symantec.com E-Mail: jmiller () securityfocus com
Current thread:
- Default Screen Saver Vulnerability in Microsoft Windows susam . pal (May 24)
- Re: Default Screen Saver Vulnerability in Microsoft Windows Eliah Kagan (May 24)
- Re: Default Screen Saver Vulnerability in Microsoft Windows Ansgar -59cobalt- Wiechers (May 24)
- Re: Default Screen Saver Vulnerability in Microsoft Windows Jason V. Miller (May 25)