mailing list archives
Re: MS Windows Screensaver Privilege Escalation
From: "Pavel Kankovsky" <peak () argo troja mff cuni cz>
Date: Sun, 28 Nov 2004 01:34:08 +0100 (CET)
On Thu, 25 Nov 2004, 3APA3A wrote:
Power Users can install software, so they can replace any file in
SYSTEM32 directory, including screensaver. It allows to trojan any
system file (for example, one can replace winspool.exe with cmd.exe to
obtain SYSTEM permissions). It's by design and it's documented. Just
never assign users in Power Users group, as Microsoft recommends you. I
see no security vulnerability here.
They have two different groups of users: more or less almighty
Administrators and Power Users who are supposed to be less powerful. But
Power Users are in fact as powerful as Administrators. This leads to a
false sense of security and this is a vulnerability...even if it might not
be a vulnerability in the technical sense. Why don't they remove the group
or disable it when users should not be assigned to it?
Moreover, it is pretty stupid to give users rights to modify critical
system directories just to let them install new software.
--Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."
Full-Disclosure - We believe in it.