bugtraq - Re: Default Screen Saver Vulnerability in Microsoft Windows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20060524225213.GC16442@securityfocus.com>
Date: Wed, 24 May 2006 16:52:13 -0600
From: "Jason V. Miller" <jmiller@...urityfocus.com>
To: bugtraq@...urityfocus.com
Cc: Ansgar -59cobalt- Wiechers <bugtraq@...netcobalt.net>
Subject: Re: Default Screen Saver Vulnerability in Microsoft Windows

On Wed, May 24, 2006 at 08:52:18PM +0200, Ansgar -59cobalt- Wiechers wrote:
> To be able to write to this registry key or to %SystemRoot%\system32
> administrative or system privileges are required. Why do you believe
> this to be a vulnerability?

To the best of my recollection, this is actually an issue on NT4. In the
event that you opt not to install the screen savers during installation, a
normal user is able to create ``logon.scr'' in ``%systemroot%\system32'',
as the default permissions on this directory include Everyone:Change. This
facilitates local privilege escalation from a normal user to LocalSystem.

At least, that's how I remember it working. I think I mentioned this to
Microsoft around 5 years ago, but they didn't consider it to be a problem.

J.

-- 
Jason V. Miller, Threat Analyst
Symantec, Inc. - www.symantec.com
E-Mail:	jmiller@...urityfocus.com