|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: Default Screen Saver Vulnerability in Microsoft Windows
From: Jason V. Miller (jmiller
securityfocus.com)
Date: Wed May 24 2006 - 17:52:13 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On Wed, May 24, 2006 at 08:52:18PM +0200, Ansgar -59cobalt- Wiechers wrote:
> To be able to write to this registry key or to %SystemRoot%\system32
> administrative or system privileges are required. Why do you believe
> this to be a vulnerability?
To the best of my recollection, this is actually an issue on NT4. In the
event that you opt not to install the screen savers during installation, a
normal user is able to create ``logon.scr'' in ``%systemroot%\system32'',
as the default permissions on this directory include Everyone:Change. This
facilitates local privilege escalation from a normal user to LocalSystem.
At least, that's how I remember it working. I think I mentioned this to
Microsoft around 5 years ago, but they didn't consider it to be a problem.
J.
--
Jason V. Miller, Threat Analyst
Symantec, Inc. - www.symantec.com
E-Mail: jmillersecurityfocus.com
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]