Vista's UAC Flawed
ASE Bot
Joined: January 10, 1995
Status: Offline
Posts: 120
Rep: 
Wed Feb 14, 2007 6:52:14 AMThere is a new news item posted at »ASE Labs
»Vista\'s UAC Flawed
It seems that the Vista User Account Control 'feature' that was put in place to stop people from using admin accounts all day has some bad features... <a href="http://blogs.zdnet.com/security/?p=29">Anything that gets installed runs the installer with admin privs period</a>. This is terrible.
Please add your comments below.
»Vista\'s UAC Flawed
It seems that the Vista User Account Control 'feature' that was put in place to stop people from using admin accounts all day has some bad features... <a href="http://blogs.zdnet.com/security/?p=29">Anything that gets installed runs the installer with admin privs period</a>. This is terrible.
Quote
That's because Vista uses a compatibility database and several heuristics to recognize installer executables and, every time the OS detects that an executable is a setup program, "it will only allow running it as administrator." This, in Rutkowska's mind, is a "very severe hole in the design of UAC." "After all, I would like to be offered a choice whether to fully trust given installer executable (and run it as full administrator) or just allow it to add a folder in Crogram Files and some keys under HKLMSoftware and do nothing more. I could do that under XP, but apparently I can’t under Vista, which is a bit disturbing," she added. A few days after Rutkowska flagged the UAC shortcoming, Microsoft's Mark Russinovich wrote a detailed technical explanation of the way the mechanism works. One thing that stood out in Russinovich's explanation is an admission of sorts that the default configuration of UAC puts the user at risk of a sophisticated code execution attack.
Please add your comments below.
Joined: February 13, 2007
Status: Offline
Posts: 8
Rep: 
Joined: December 6, 2005
Status: Offline
Posts: 930
Rep:
Page:
[1]