Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: MS Windows Screensaver Privilege Escalation
From: devis <devis () easynix net>
Date: Sun, 28 Nov 2004 04:15:10 +0100

Pavel Kankovsky wrote:

On Thu, 25 Nov 2004, 3APA3A wrote:

They have two different groups of users: more or less almighty
Administrators and Power Users who are supposed to be less powerful. But
Power Users are in fact as powerful as Administrators. This leads to a
false sense of security and this is a vulnerability...even if it might not
be a vulnerability in the technical sense. Why don't they remove the group or disable it when users should not be assigned to it?

Moreover, it is pretty stupid to give users rights to modify critical
system directories just to let them install new software.

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


I have to completely agree on both points. But will MS switch to a real secure model or will it keep its 'useability' by running 'default' priviledged ?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]