-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160
Reed Arvin wrote:
> Sir,
>
> On Windows 2000 operating systems the default permissions for the root
> of the OS drive is Everyone/Full Control. However, with Microsoft
> operating systems newer than Windows 2000 administrative privileges
> are necessary. Thank you for your comment.
>
> Regards,
> Reed
As I addressed in my previous post:
http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/040558.html
this default ACL is itself a security risk. Windows 2000 systems with
Everyone/Full Control permissions on the installation volume are
susceptible to search path attacks irrespective of this VirusScan
"vulnerability".
Windows 2000 workstations with default ACLs applied that are consistent
with those in MS02-064 are *NOT* susceptible to the attacks you describe.
While this is a weakness in the VirusScan code and it should be fixed,
it does not expose systems to privilege escalation attacks in any
real-world scenario where those systems have secure ACLs on the
involved directories (install volume root and program files) as I describe.
This issue amounts to sloppy coding and is not a realistically
exploitable attack unless your systems have permissions in place that
expose them to compromise as-is. Your Windows 2000 system's default ACL
is an example of that, and is not a secure environment, VirusScan or no.
There's no reason to concern people needlessly by claiming that this
issue has any likelihood of broad impact.
Regards,
Matt Murphy
- --
"Social Darwinism: Try to make something idiot-proof,
nature will provide you with a better idiot."
-- Michael Holstein
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFDq4O1fp4vUrVETTgRA8JPAJ4mgTjnxNIJV4tUYepOOP0cLGh0zgCgk9pL
/3KpevcghdEd8bN3LGuyKw0=
=joTP
-----END PGP SIGNATURE-----
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/