Windows flaw allows privilege escalation, Vista affected

**Anilrgowda** · 28-Feb-2007, 07:32 AM

Windows flaw allows privilege escalation, Vista affected

Security research firm eEye has found a bug in Windows which can be used by standard users for privilege escalation. eEye's web site has given the flaw a ration of "Medium," and the vulnerability was reported to Microsoft on January 19, 2007.
While he didn't feel that this bug warranted a high security rating, eEye's Marc Maiffret warned that it could give users who normally run as the least privileged user to escalate themselves into an Administrator. For corporate networks, the vulnerability could be dangerous. "They have fewer privileges in Vista than they did in Windows XP. When regular users are running the operating system, they have regular user-level access, but with this vulnerability, you can elevate yourself to system-level access. Any normal user can do anything they want to the system."
The flaw stems from the "ReadDirectoryChangesW" API call which fails to check user permissions on child objects that the user does not have "LIST" permissions for. More information on the function can be found in the MSDN.
Microsoft is staying fairly silent on this issue. The company has only said that it is looking into the reports, but has not received any word of attacks or attempted exploits. Right now, there's no need for alarm, but Maiffret mentions that this could become a much larger issue if someone decides to package a virus along with the flaw. "Viruses are very prevalent and there are plenty of other vulnerabilities you can couple it with. In a real world context, it's high because there are a lot of other things you can couple it with to make it pretty nasty."
Other operating systems affected by the vulnerability include Windows 2000 Service Pack 4, Windows XP Service Pack 2, and Windows Server 2003 Service Pack 1. Although this bug is grabbing headlines for being one of the first "big ones" in Vista, it's probably more important that Microsoft focuses on fixing the problem in Windows Server 2003 and XP.

Source:http://arstechnica.com/journals/micr...2007/2/28/7256

28-Feb-2007, 07:32 AM	#1 (permalink)
Anilrgowda Administrator Posts: 18,695 Join Date: Jan 2006 Rep Power: 10 IM:	Windows flaw allows privilege escalation, Vista affected Windows flaw allows privilege escalation, Vista affected Security research firm eEye has found a bug in Windows which can be used by standard users for privilege escalation. eEye's web site has given the flaw a ration of "Medium," and the vulnerability was reported to Microsoft on January 19, 2007. While he didn't feel that this bug warranted a high security rating, eEye's Marc Maiffret warned that it could give users who normally run as the least privileged user to escalate themselves into an Administrator. For corporate networks, the vulnerability could be dangerous. "They have fewer privileges in Vista than they did in Windows XP. When regular users are running the operating system, they have regular user-level access, but with this vulnerability, you can elevate yourself to system-level access. Any normal user can do anything they want to the system." The flaw stems from the "ReadDirectoryChangesW" API call which fails to check user permissions on child objects that the user does not have "LIST" permissions for. More information on the function can be found in the MSDN. Microsoft is staying fairly silent on this issue. The company has only said that it is looking into the reports, but has not received any word of attacks or attempted exploits. Right now, there's no need for alarm, but Maiffret mentions that this could become a much larger issue if someone decides to package a virus along with the flaw. "Viruses are very prevalent and there are plenty of other vulnerabilities you can couple it with. In a real world context, it's high because there are a lot of other things you can couple it with to make it pretty nasty." Other operating systems affected by the vulnerability include Windows 2000 Service Pack 4, Windows XP Service Pack 2, and Windows Server 2003 Service Pack 1. Although this bug is grabbing headlines for being one of the first "big ones" in Vista, it's probably more important that Microsoft focuses on fixing the problem in Windows Server 2003 and XP. Source:http://arstechnica.com/journals/micr...2007/2/28/7256

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)