full-disclosure - Question for the Windows pros

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed Jan 18 15:34:12 2006
From: pauls at utdallas.edu (Paul Schmehl)
Subject: Question for the Windows pros

Win 2000 SP 4 and Win XP both incorporated two new security features; 
Create global objects and Impersonate client after authentication.  Both 
are restricted to Administrators, SYSTEM or other privileged accounts.

What are the risks associated with granting Authenticated Users (AD 2003) 
the Impersonate client after authentication privilege?  I've googled and 
read endlessly repetitive explanations for what the privilege is (most of 
them nearly incomprehensible), but I have yet to find anyone who 
articulates the risks associated with such a change.  ISS claims it's a 
HIGH risk but then gives no explanation why that is so.

Would this expose a workstation to a Blaster-type worm, for example?  Open 
it up to remote attack?  If so, what is required to conduct the attack? 
What ports would be involved?

Pointers to white papers or talks at conferences would be greatly 
appreciated.

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/