Mitigate the Image Uploader Vulnerabilities

re: Mitigate the Image Uploader Vulnerabilities

Anthony Perkins — Fri, 15 Feb 2008 07:04:45 GMT

Jesper, thanks for your work on this.

re: Mitigate the Image Uploader Vulnerabilities

Roshan James — Thu, 14 Feb 2008 16:39:17 GMT

Sorry for a comment that is a little out of place. What brings me to your website is your article about ACLs and such.

www.microsoft.com/.../sm1105.mspx

There you say strange things like this:

"Power Users are administrators who simply have not made themselves administrators yet.

You cannot remove the ACLs on the file system, or even the registry, and prevent that. Power Users are ingrained in the operating system, and they have sufficient privileges to escalate to an administrator fairly easily."

At the risk of sounding obnoxious I must say, I am baffled by how anyone is expected to know this. Is there some place where this is all written down is a accessible way? Maybe a lattice of builtin users and a lattice of ACL permissions?

I am try to decipher the ACL format of icacls, at it is simply so hard to find any readable and reliable information about this. Would you know where I might find some?

I see from your technet webpage that you left the company. Congratulations.

re: Mitigate the Image Uploader Vulnerabilities

jesper — Sun, 10 Feb 2008 18:19:25 GMT

Of course Aaron. I meant to say startup script. Fixing now.

re: Mitigate the Image Uploader Vulnerabilities

Aaron Margosis — Sun, 10 Feb 2008 14:15:04 GMT

I think it's more accurate to call it a "startup script" rather than a "logon script": logon scripts run in the security context of the user logging on, while startup scripts run as System. You need the latter here, since users can't set those kill bits. (The instructions you wrote indicate a "startup script", which is correct, so it's just about terminology.)