Full Disclosure mailing list archives
Re: MS Windows Screensaver Privilege Escalation
From: "Pavel Kankovsky" <peak () argo troja mff cuni cz>
Date: Sun, 28 Nov 2004 01:34:08 +0100 (CET)
On Thu, 25 Nov 2004, 3APA3A wrote:
Power Users can install software, so they can replace any file in SYSTEM32 directory, including screensaver. It allows to trojan any system file (for example, one can replace winspool.exe with cmd.exe to obtain SYSTEM permissions). It's by design and it's documented. Just never assign users in Power Users group, as Microsoft recommends you. I see no security vulnerability here.
They have two different groups of users: more or less almighty Administrators and Power Users who are supposed to be less powerful. But Power Users are in fact as powerful as Administrators. This leads to a false sense of security and this is a vulnerability...even if it might not be a vulnerability in the technical sense. Why don't they remove the group or disable it when users should not be assigned to it? Moreover, it is pretty stupid to give users rights to modify critical system directories just to let them install new software. --Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ] "Resistance is futile. Open your source code and prepare for assimilation." _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- MS Windows Screensaver Privilege Escalation Matthew Walker (Nov 24)
- RE: MS Windows Screensaver Privilege Escalation joe (Nov 24)
- RE: [in] MS Windows Screensaver Privilege Escalation Curt Purdy (Nov 24)
- Re: MS Windows Screensaver Privilege Escalation 3APA3A (Nov 25)
- Re: MS Windows Screensaver Privilege Escalation Matt Andreko (Nov 27)
- Re[2]: MS Windows Screensaver Privilege Escalation 3APA3A (Nov 27)
- Re: MS Windows Screensaver Privilege Escalation Matt Andreko (Nov 27)
- Re[2]: MS Windows Screensaver Privilege Escalation 3APA3A (Nov 27)
- Re: MS Windows Screensaver Privilege Escalation David Vincent (Nov 27)
- Re: MS Windows Screensaver Privilege Escalation Matt Andreko (Nov 27)
- Re: MS Windows Screensaver Privilege Escalation Pavel Kankovsky (Nov 28)
- Re: MS Windows Screensaver Privilege Escalation devis (Nov 28)
- Re: MS Windows Screensaver Privilege Escalation Nick FitzGerald (Nov 28)
- Re: MS Windows Screensaver Privilege Escalation Paul Schmehl (Nov 29)
- RE: MS Windows Screensaver Privilege Escalation Kovács László (Nov 29)
- <Possible follow-ups>
- RE: MS Windows Screensaver Privilege Escalation Stuart Fox (DSL AK) (Nov 24)
- Re[2]: MS Windows Screensaver Privilege Escalation 3APA3A (Nov 25)