full-disclosure - MS Windows Screensaver Privilege Escalation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20041128003408.28697.qmail@paddy.troja.mff.cuni.cz>
From: peak at argo.troja.mff.cuni.cz (Pavel Kankovsky)
Subject: MS Windows Screensaver Privilege Escalation

On Thu, 25 Nov 2004, 3APA3A wrote:

> Power  Users  can  install  software,  so  they  can replace any file in
> SYSTEM32  directory,  including  screensaver.  It  allows  to trojan any
> system  file  (for example, one can replace winspool.exe with cmd.exe to
> obtain  SYSTEM  permissions).  It's  by design and it's documented. Just
> never  assign users in Power Users group, as Microsoft recommends you. I
> see no security vulnerability here.

They have two different groups of users: more or less almighty
Administrators and Power Users who are supposed to be less powerful. But
Power Users are in fact as powerful as Administrators. This leads to a
false sense of security and this is a vulnerability...even if it might not
be a vulnerability in the technical sense. Why don't they remove the group 
or disable it when users should not be assigned to it?

Moreover, it is pretty stupid to give users rights to modify critical
system directories just to let them install new software.

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."