mailing list archives
Question for the Windows pros
From: Paul Schmehl <pauls () utdallas edu>
Date: Wed, 18 Jan 2006 09:34:02 -0600
Win 2000 SP 4 and Win XP both incorporated two new security features;
Create global objects and Impersonate client after authentication. Both
are restricted to Administrators, SYSTEM or other privileged accounts.
What are the risks associated with granting Authenticated Users (AD 2003)
the Impersonate client after authentication privilege? I've googled and
read endlessly repetitive explanations for what the privilege is (most of
them nearly incomprehensible), but I have yet to find anyone who
articulates the risks associated with such a change. ISS claims it's a
HIGH risk but then gives no explanation why that is so.
Would this expose a workstation to a Blaster-type worm, for example? Open
it up to remote attack? If so, what is required to conduct the attack?
What ports would be involved?
Pointers to white papers or talks at conferences would be greatly
Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Question for the Windows pros Paul Schmehl (Jan 18)