Command injection

Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs run as command, to kill arbitrary processes of this other user, as demonstrated by the taskkill program. NOTE: the researcher claims a vendor dispute in which the vendor states that "RunAs and UAC are...

CVE-2007-3463

Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs run as command, to kill arbitrary processes of this other user, as demonstrated by the taskkill program. NOTE: the researcher claims a vendor dispute in which the vendor states that "RunAs and UAC are...

CVE-2007-3463

Microsoft Windows XP SP2 local privilege escalation CVE-2007-3463 allows a user who has a RunAs session to terminate arbitrary processes of another user, demonstrated by taskkill. Root cause relates to RunAs/UAC being treated as convenience features, not security boundaries. The connected sources...

CVE-2007-3463

Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs run as command, to kill arbitrary processes of this other user, as demonstrated by the taskkill program. NOTE: the researcher claims a vendor dispute in which the vendor states that "RunAs and UAC are...

MS Windows (keybd_event) Local Privilege Elevation Exploit

No description provided by source. / Microsoft Windows keybdevent validation vulnerability. Local privilege elevation Credits: Andres Tarasco aT4r @ haxorcitos.com Iaki Lopez ilo @ reversing.org Platforms afected/tested: - Windows 2000 - Windows XP - Windows 2003 Original Advisory:...

Microsoft Windows software restriction policy protection bypass

By using RunAs function it's possible to launch any application...

Microsoft Windows RunAs GPO restrictions protection bypass

It's possible to use RunAs with restricted application...

[NT] RunAs Allows Bypassing User GPO in Windows XP/2003

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

In W2K, elevated several attack instances of success or failure experiences-vulnerability and early warning-the black bar safety net

Speaking of the Virus are related to elevation of Privilege issues, the so-called elevation of privilege is the use of the system loopholes to obtain higher Privilege to. For example, you use the General user account to log on to Windows NT/Windows 2 0 0 0, You can only make a limited operation,...

In W2K, elevated several attack instances of success or failure experiences-vulnerability and early warning-the black bar safety net

Speaking of the Virus are related to elevation of Privilege issues, the so-called elevation of privilege is the use of the system loopholes to obtain higher Privilege to. For example, you use the General user account to log on to Windows NT/Windows 2 0 0 0, You can only make a limited operation,...

[Full-disclosure] Microsoft Windows keybd_event validation vulnerability

Vulnerability: Microsoft Windows keybdevent validation vulnerability. Type:......... Design Flaw Vendor:....... Microsoft Impact:....... Local Privilege Elevation. Credits:...... AndrTarascaT4r @ Haxorcitos.comhttp://Haxorcitos.com .......I Lopez ilo @ reversing.org http://reversing.org...

Microsoft Windows XP20002003 - Keyboard Event Privilege Escalation

Microsoft Windows XP20002003 - Keyboard Event Privilege Escalation // source: https://www.securityfocus.com/bid/14743/info Microsoft Windows is prone to a privilege escalation weakness. This issue is due to a design error when desktop applications handle keyboard events sent through the keybdeven...

CVE-2001-1518

RunAs runas.exe in Windows 2000 only creates one session instance at a time, which allows local users to cause a denial of service RunAs hang by creating a named pipe session with the authentication server without any request for service. NOTE: the vendor disputes this vulnerability, however the...

CVE-2001-1517

CVE-2001-1517 affects Windows 2000 RunAs (runas.exe). The issue is that cleartext authentication data is stored in memory, potentially allowing a attacker to recover usernames and passwords by a process sharing the same memory page after a RunAs operation ends. Evidence in connected sources confi...

CVE-2001-1519

CVE-2001-1519 affects Windows 2000 RunAs (runas.exe). Multiple sources describe a local-privilege issue where, if the RunAs service is stopped, a local attacker can create a spoofed named pipe and potentially capture cleartext usernames and passwords when clients connect. The Red Hat and CVE/CVE-...

CVE-2001-1517

RunAs runas.exe in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames and passwords by executing a process that is allocated the same memory page after termination of a RunAs command. NOTE: the vendor disputes this issue, saying tha...

CVE-2001-1519

RunAs runas.exe in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to...

mast.txt

Hi list, Just found an implementation bug in MAST RunAsP.exe v3.5.1 and below, that allows local privilege escalation. Vendor: MAST-Computer Homepage of product : http://www.mast-computer.com/c9-s7-len.html Description of product: For Windows 2000, Windows XP RunAs Professional is a substitute fo...

CVE-2001-1519

RunAs runas.exe in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to...

CVE-2001-1517

RunAs runas.exe in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames and passwords by executing a process that is allocated the same memory page after termination of a RunAs command. NOTE: the vendor disputes this issue, saying tha...