full-disclosure - Question for the Windows pros

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1137606000.18404.25.camel@localhost>
Date: Wed Jan 18 17:40:14 2006
From: frank at knobbe.us (Frank Knobbe)
Subject: Question for the Windows pros

On Wed, 2006-01-18 at 11:30 -0600, Paul Schmehl wrote:
> I can read.  I need to know, from a practical application standpoint, what 
> does this mean.  What are the exposures?

Sounds to me like that right allows a user to assume the security
context of another user. Think of "RunAs" where a user runs a procedure
as a different user.

*That* ability should tell you a lot of what the exposures are. It's
seems similar to allowing your *nix users to use su (without password
check) to assume another user. (As root you can "su username" and you
are that user. Imagine of your normal users could do that).

I don't see why you would ever need to grant a normal user such a right.
It may be of interest for service accounts, though.

Regards,
Frank

-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060118/6f4e95c9/attachment.bin