Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Question for the Windows pros
From: Paul Schmehl <pauls () utdallas edu>
Date: Wed, 18 Jan 2006 09:34:02 -0600

Win 2000 SP 4 and Win XP both incorporated two new security features; Create global objects and Impersonate client after authentication. Both are restricted to Administrators, SYSTEM or other privileged accounts.

What are the risks associated with granting Authenticated Users (AD 2003) the Impersonate client after authentication privilege? I've googled and read endlessly repetitive explanations for what the privilege is (most of them nearly incomprehensible), but I have yet to find anyone who articulates the risks associated with such a change. ISS claims it's a HIGH risk but then gives no explanation why that is so.

Would this expose a workstation to a Blaster-type worm, for example? Open it up to remote attack? If so, what is required to conduct the attack? What ports would be involved?

Pointers to white papers or talks at conferences would be greatly appreciated.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]