Over 1 million tech questions and answers.

Vulnerability in Windows Could Allow Elevation of Privilege

Q: Vulnerability in Windows Could Allow Elevation of Privilege

Hiya

A privilege elevation vulnerability exists in the way that Microsoft Windows starts applications with specially crafted file manifests. This vulnerability could allow a logged on user to take complete control of the system

Affected Software:

Microsoft Windows XP Service Pack 2
Microsoft Windows Server 2003
Microsoft Windows Server 2003 for Itanium-based Systems

http://www.microsoft.com/technet/security/bulletin/ms06-075.mspx

Regards

eddie

Read other answers
RELEVANCY SCORE 200
Preferred Solution: Vulnerability in Windows Could Allow Elevation of Privilege

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

RELEVANCY SCORE 108.8

Hello,
I'm with security issue CVE-2020-1472 | Netlogon Elevation of Privilege Vulnerability and the following occurs to me:

I'm having trouble starting to collect events 5827-5831
I have installed the August 2020 update on a DC Microsot Windows Server 2012 R2 to start the event collection, and no events appear, even when logging in with Microsoft Windows Server 2012 without the August update.

I have set the FullSecureChannelProtection registry key to 1, and from a server with Microsoft Windows Server 2012 without the August 2020 update I can login without problems.

No events appear in the security log and I can login without problems with FullSecureChannelProtection at 1. I don't understand where the problem is. Can anyone give me any clues?

sorry for my english
Thanks

Read other answers
RELEVANCY SCORE 107.6

Hi everyone,
Our Nessus scanner detected the following vulnerability :


Description
<section>

The version of Microsoft Malware Protection Signature Update Stub (MpSigStub.exe) installed on the remote Windows host is prior to 1.1.16200.1. It is, therefore, affected by a elevation of privilege vulnerability which could allow an attacker who successfully
exploited this vulnerability to elevate privileges on the system.

</section>
Solution
<section>

Enable automatic updates to update the scan engine for the relevant antimalware applications. Refer to Knowledge Base Article 2510781 for information on how to verify that MMPE has been updated.

</section>
Plugin Output
<section>
Product : Microsoft Malware Protection Signature Update Stub
Path : C:\Windows\System32\MpSigStub.exe
Installed version : 1.1.15000.2
Fixed version : 1.1.16200.1
</section>
I don't understand how to fix that issue, is there any patches ?
Regards,
Lucas

Read other answers
RELEVANCY SCORE 106.4

Hi
With this latest vulnerability, i need some clarification about what exactly is a "Non-Compliant Device".
In the KB articles definition, A non-compliant device is one that uses a vulnerable Netlogon secure channel connection.
So that means, lets say you have a Windows machine, that has not been patched correctly, and still uses vulnerable netlogon connection.
So once the DC is patched for this vulnerability, what will happen to this Windows machine?
Will it get denied connection and be reported in event ID: 5827/5828?
Or will it be allowed connection, as it is technically a non-compliant device based on the definition, as it is using vulnerable netlogon connection? And be logged under event ID: 5829?

The other question i have is for the use of the GPO policy: "Domain controller: Allow vulnerable Netlogon secure channel connections"
So i understand that this will bypass the enforcement.
However, if the "Non-Compliant" device is not a windows device, i will assume that the GPO will not work for these devices. So when in enforcement phase, for these such non windows devices that is still using vulnerable netlogon connection, there
is no workaround right? Either get vendor to provide a fix or decommission?

Thanks DM.

DM

Read other answers
RELEVANCY SCORE 84.8

Hiya

The Windows Redirector is used by a Windows client to access files,
whether local or remote, regardless of the underlying network
protocols in use. For example, the "Add a Network Place" Wizard or
the NET USE command can be used to map a network share as a local
drive, and the Windows Redirector will handle the routing of
information to and from the network share.

A security vulnerability exists in the implementation of the
Windows Redirector on Windows XP because an unchecked buffer is
used to receive parameter information. By providing malformed data
to the Windows Redirector, an attacker could cause the system to
fail, or if the data was crafted in a particular way, could run
code of the attacker's choice.
Maximum Severity Rating: Important

Affected Software:

Microsoft Windows XP

Download locations for this patch

Windows XP:
32-bit Edition

64-bit Edition

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-005.asp

Regards

eddie
 

Read other answers
RELEVANCY SCORE 78.4

Hiya

This patch is a cumulative patch that includes the functionality of
all security patches released to date for IIS 5.0, and all patches
released for IIS 4.0 since Windows NT(r) 4.0 Service Pack 5. A
complete listing of the patches superseded by this patch is provided
below, in the section titled "Additional information about this
patch". Before applying the patch, system administrators should take
note of the caveats discussed in the same section

http://www.microsoft.com/technet/security/bulletin/ms01-044.asp
Regards

eddie
 

Read other answers
RELEVANCY SCORE 75.2

Hiya

The Network Connection Manager (NCM) provides a controlling
mechanism for all network connections managed by a host system.
Among the functions of the NCM is to call a handler routine
whenever a network connection has been established.

By design, this handler routine should run in the security context
of the user. However, a flaw could make it possible for an
unprivileged user to cause the handler routine to run in the
security context of LocalSystem, though a very complex process.
An attacker who exploited this flaw could specify code of his or
her choice as the handler, then establish a network connection
in order to cause that code to be invoked by the NCM. The code
would then run with full system privileges.

Maximum Severity Rating: Critical

Affected Software:

Microsoft Windows 2000

Download locations for this patch
Microsoft Windows 2000:

http://www.microsoft.com/downloads/Release.asp?ReleaseID=41406

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms02-042.asp

Regards

eddie
 

Read other answers
RELEVANCY SCORE 74.4

SEP 12.1 RU6 MP6 and earlier as well as SEP 14.1 MP1 are vulnerable as per CVE-2016-9093, CVE-2016-9094

Users running SEP 12.1 are advised to upgrade to SEP12.1 RU6 MP7. Users running SEP 14.1 are advised to update to SEP 14.1 MP1
 

Read other answers
RELEVANCY SCORE 68.8

 
Lutomirski had recently reported the CVE-2014-9090 which was caused due to improper handling of faults associated with the Stack Segment (SS) register on the x86 architecture. After notification of CVE-2014-9090, Borislav Petkov pointed out to Lutomirski some further flaws that existed even after vulnerability.  After  research Lutomirski discovered that there were two bugs in the improper handling of Stack Segment (SS) register.  The new kernel kernel vulnerability is now identified CVE-2014-9322 and allows potential hacker to  gain privilege escalation on all X86_64 systems.
 
 
“Any kernel that is not patched against CVE-2014-9090 is vulnerable to privilege escalation due to incorrect handling of a #SS fault caused by an IRET instruction. In particular, if IRET executes on a writeable kernel stack (this was always the case before 3.16 and is sometimes the case on 3.16 and newer), the assembly function general_protection will execute with the user’s gsbase and the kernel’s gsbase swapped,” Lutomirski explained in an advisory.
He added that, “This is likely to be easy to exploit for privilege escalation, except on systems with SMAP or UDEREF. On those systems, assuming that the mitigation works correctly, the impact of this bug may be limited to massive memory corruption and an eventual crash or reboot.”
Privilege Escalation Vulnerability in Linux #CVE-2014-9322
 
.

Read other answers
RELEVANCY SCORE 68.4

 
Security researchers have find out ways to hijack the Intel-compatible PCs running Linux by exploiting the physical weaknesses in certain varieties of DDR DRAM (double data rate dynamic random-access memory) chips and gaining higher kernel privileges on the system.
 
The technique, dubbed "rowhammer", was outlined in a blog post published Monday by Google's Project Zero security initiative, a team of top security researchers dedicatedly identifies severe zero-day vulnerabilities in different software.
 
Rowhammer is a problem with recent generation DRAM chips in which repeatedly accessing a row of memory can cause "bit flipping" in an adjacent row which could allow anyone to change the value of contents stored in computer memory.
 
 
WHAT IS ROWHAMMER BUG
DDR memory is arranged in an array of rows and columns, which are assigned to various services, applications and OS resources in large blocks. In order to prevent each application from accessing the memory of other application, they are kept in a "sandbox" protection layer.
 
However, Sandbox protection can be bypassed using Bit flipping technique in which a malicious application needs to repeatedly access adjacent rows of memory in a tiny fraction of a second.
 
As a result, hammering two aggressor memory regions can disturb neighbouring locations, causing charge to leak into or out of neighbouring cells.

DRAM Rowhammer vulnerability Leads to Kernel Privilege Escalation

A:DRAM Rowhammer vulnerability Leads to Kernel Privilege Escalation

Program for testing for the DRAM "rowhammer" problem
The test should work on Linux or Mac OS X, on x86 only.
 
 
https://github.com/google/rowhammer-test
 

Read other 4 answers
RELEVANCY SCORE 68.4

A vulnerability in the Panda 2016 products that allows the execution of code with elevated permissions has been detected in Small Business Protection and Panda 2016 products. The PSEvents.exe process is periodically run with elevated permissions and has dependencies of libraries located both in the default directory as well as in other system libraries. As the USERS group has Write permissions over the folder where the PSEvent.exe process is run and because the system first looks for libraries run by this process in the execution folder, it may be possible to create a malicious library in the execution folder that will replace one of the libraries installed in other folders. Therefore, a user could run malicious code with SYSTEM privileges.

Privilege escalation vulnerability in PSEvents.exe with Panda 2016 products - Technical Support - Panda Security
 

Read other answers
RELEVANCY SCORE 56.8

I have seen this question asked before and attempted a few solutions. Fixing computer problems is not my forte and I would really like an easy to followed solution. I have downloaded the program Apache OpenOffice 4.1.2. It has converted most of my files to OpenOffice.org XML 1.0 Spreadsheet. When I first downloaded them and was able to open some they would only open as spreadsheet files, OpenOffice calc. Now all I get is the above message.
I'm not wishing to make myself unwelcomed as a new comer but I have found things becoming more and more complicated and not as easily fixed since moving from Windows 7. Unfortunately, for me, when I purchased my current laptop it came with W8 which I managed to cope with only just. When W10 came along I was drawn in by the online recommendations and went along with the upgrade.
A friend of mine who knows a lot more about computers than I do has stayed with Windows 7 because of all the reports that are circulating about the problems. He has helped me out with a download that I purchased and was not able to install with Windows 10 by using his Windows 7. He has also downloaded and is using Apache OpenOffice without any problems.
I would just like some help to sort out these problems which Windows 10, I'm sorry to say, seems to be creating. It's getting to the stage where I'll be needing an outside Technician to come help me out which is not what I would prefer

A:The requested elevation requires elevation

Hi easily confused,

I did some checking, and it looks as if it might be a permission error. See HERE for details.

Also, if you are unable to get that sorted out, there is the option of using a replacement program called LibreOffice. See HERE to compare the two.

Hang in there with Win-10 as these bugs will resolve in time and sooner or later. The one thing that might help might be to do a clean install, rather than a basic upgrade. See HERE.

b1rd

Read other 0 answers
RELEVANCY SCORE 56.8

I have seen this question asked before and attempted a few solutions. Fixing computer problems is not my forte and I would really like an easy to followed solution. I have downloaded the program Apache OpenOffice 4.1.2. It has converted most of my files to OpenOffice.org XML 1.0 Spreadsheet. When I first downloaded them and was able to open some they would only open as spreadsheet files, OpenOffice calc. Now all I get is the above message.
I'm not wishing to make myself unwelcomed as a new comer but I have found things becoming more and more complicated and not as easily fixed since moving from Windows 7. Unfortunately, for me, when I purchased my current laptop it came with W8 which I managed to cope with only just. When W10 came along I was drawn in by the online recommendations and went along with the upgrade.
A friend of mine who knows a lot more about computers than I do has stayed with Windows 7 because of all the reports that are circulating about the problems. He has helped me out with a download that I purchased and was not able to install with Windows 10 by using his Windows 7. He has also downloaded and is using Apache OpenOffice without any problems.
I would just like some help to sort out these problems which Windows 10, I'm sorry to say, seems to be creating. It's getting to the stage where I'll be needing an outside Technician to come help me out which is not what I would prefer

A:The requested elevation requires elevation

Hi easily confused,

I did some checking, and it looks as if it might be a permission error. See HERE for details.

Also, if you are unable to get that sorted out, there is the option of using a replacement program called LibreOffice. See HERE to compare the two.

Hang in there with Win-10 as these bugs will resolve in time and sooner or later. The one thing that might help might be to do a clean install, rather than a basic upgrade. See HERE.

b1rd

Read other 3 answers
RELEVANCY SCORE 49.6

Hello,

I have an application that is run from the command line. I cannot get the application to run without error unless I run as administrator. I have two newer versions of the same application that run just fine and do not require administrator. The differences in the code between the versions are not extensive and I can't figure out why the old version needs elevation to administrator to run. These applications were built with gnu cpp and don't have a manifest. The application is actually two binaries that communicate through shared memory. There is a parent process that launches a child process, passes data to the child, and receives data back. I don't know what this would have to do with anything because the versions that work do the same thing as the versions that don't.

Can anyone here shed any light on reasons why windows 7 would require administrator and possible work-arounds?

LMHmedchem

A:why does windows 7 require elevation to administrator?

For security reasons Windows requires admin privileges to access many system resources. This has been a feature of the NT platform since the beginning. Each new version of Windows has tightened up security to meet the demands of the world of today. That creates some issues for applications designed for older operating systems, particularly when running with a non admin account. Needed resources that were accessible on older systems can no longer be accessed without an admin level account. Newer applications were designed for the more modern tightened security and they run as expected. They may not with a future OS.

Workarounds, if any, will depend on the details of the situation.

Read other 9 answers
RELEVANCY SCORE 49.2

From:- http://www.microsoft.com/technet/tec...litySpotlight/






Script Elevation PowerToys for Windows Vista


Download the code for this article: Utility2007_06.exe (159KB)


Among the many features Windows Vista introduced to address security concerns, User Account Control (UAC) is one of the most significant. With User Account Control, even users who are administrators run most applications with standard privilege, but have "elevation potential" for specific administrative tasks and
application functions. After using Windows Vista™ for many months, elevating a task or application as necessary has become second nature. However, I also encountered a number of shortcomings when trying to elevate some types of tasks in Windows Vista, and that became frustrating.
So in the spirit of the old Windows? PowerToys, I’ve created a few Script Elevation PowerToys to overcome these limitations. You can find all of the PowerToys I’m about to discuss in the code download at technetmagazine .com/code07.aspx. And you can read about how UAC works in the November 2006 article "Achieve the Non-Admin Dream with User Account Control" by Alex Heaton (see the "Additional Resources" sidebar).

Elevate Command PowerToy

The first annoyance was that there was no method to elevate an application from the command line or from the Run dialog box. So after asking around within Microsoft, I came across a sample scri... Read more

Read other answers
RELEVANCY SCORE 46.8

Working on a hp t230d with XP sp2, Have found errors while trying to delete other user accounts while logged in as an Administrator acct as well as in Safe Mode as "The" Administrator acct. Error states "lack of privilege" to delete. Have opened a new administrator acct from within safe mode/Admin acct. with no success. Also effected is trying to change Time/date, (control panel) add/remove programs, and installing some programs. I have not found any answers yet so I keep searching and searching.....Please any insight to this problem. When does the Administrator acct. lose the ability to control the computer.
 

A:Windows XP Lack of Privilege Errors- What can I do ?

And confirm you are doing this from the Local Users and Groups MMC snap-in?
 

Read other 3 answers
RELEVANCY SCORE 46.8

Hi
Windows 7 enterprise was installed in my HP Probook 4540 laptop. Somebody misused it and administrator account got hidden. Now when the computer starts, login screen only shows standard user account and no user account switching etc. when i logon using standard user account then i cannot access registry, group policy as the message come that you dont have access rights. Also when i tries to open something with "run as administrator" then still administrator windows prompt box opens but does not ask for administrative user account name and password also "yes" button disabled.
Is there any solution other than new window installation

A:Administrative privilege not working in windows 7

You have two options - contact the administrator of the company that owns the copy of enterprise you have and get them to modify the system or purchase and install another version of windows

Read other 1 answers
RELEVANCY SCORE 46.8

Hi Guys, good day & I'm sorry if this thread is already created but I don't have much time to look for it.

I'm just confuse!, about the admin privilege that affects my whole computer system, I have a two computer, one is a desktop, and one is a laptop.

When I changed the name of my Local Disk (C) from the default to new one, it doesn't ask a permission to change like the picture below

NOTE: THE IMAGE SHOWN BELOW IS FROM MY DESKTOP


And the Ownership of my Disk is set to default [TrustedInstaller].


And this is the list of all permission.


As you can see, all of the settings are set to default and nothing changed!!
but when it comes in my laptop, something is wrong

NOTE: THE IMAGE SHOWN BELOW IS FROM MY LAPTOP


And the Ownership of my Disk in Laptop is set to default [TrustedInstaller] too!!.


And the list of the permission are the same.


As you can see, all the settings from my two computers are the same, the only difference from them are the operating system which my LAPTOP IS WINDOWS 7 STARTER 32bit and my DESKTOP IS WINDOWS 7 ULTIMATE 64bit, It matters to me, to know why isn't working the same, please help me! I need to know why??


GOD BLESS AND THANK YOU!

A:Windows 7 - Administration Privilege (Little Bit Confusing)

Are UAC settings the same in both?

User Account Control - UAC - Change Notification Settings

Read other 2 answers
RELEVANCY SCORE 46

While I was modifying the security privileges in windows 7 to delete certain files I somehow managed to set my entire c:\ drive privileges to block Users. Now Even though i have administrator access I can not access any data on the main hard drive. In fact windows itself can not open and run some of its most basic functions. I tried using the cmd command prompt icacls to fix the issue but this failed and no matter how many times tried to change the permissions for anything on the c:\ drive it resulted in "access denied". I do not have a restore point in windows to go back to nor do I have a back up disk to reinstall windows. I have absolutly no clue what to do. The drive is so blocked Im not even able to run most of the basic startup programs. many of the programs that modify settings in the control panel dont even work. Like changing the system local or creating and modifying users.

A:Windows user security privilege nightmare.

Quote:

I would highly recommend that you create a restore point before making changes to a file, folder, drive, or registry key permission [COLOR=#3485bd !important][COLOR=#3485bd !important]settings[/COLOR]. This way if you make a mistake and lock (access denied) yourself out of the item, you will be able to do a system restore at boot and select the restore point to undo the mistake. Be sure to not deny permissions to or remove your user account for the file, folder, drive, or registry key. Doing so could prevent you from having access to the item.
Be sure to not deny permissions to the Everyone group for the file, folder, drive, or registry key. This will also include your user account.
Be sure to not deny permissions to or remove TrustedInstaller, LOCAL SERVICE, RESTRICTED, SERVICE, or SYSTEM if listed. Doing so will prevent Windows 7 from having access, and will cause Windows 7 to not run properly afterwards.



Hehe silly me i wish id not done this. heh i guess im screwed. Seeing as I didnt affect the administrators portion or the portion with my account name directly on it I should still be able to access my hard drive. Id call this a glitch or a problem with the software but still my idiot mistake. Problem is I dont have windows to reload onto my computer.

Read other 7 answers
RELEVANCY SCORE 46

Hi all!

I recently had an unexpected problem with a piece of software, and reinstalled Windows selecting to repair my existing installation. Now although it's downloaded the updates, when it goes to install them it simply says "Installation failed" and gives the entire list of downloaded updates as failed. When I turn my machine off, it says "Installing update 1 of 89" for about four seconds, then proceeds to "Windows is shutting down"

I also notice that in Services I have "User Privilege Service" set to manual and stopped. When I try to start it, it fails with the message "Failed to respond in a timely manner" and then forever afterwards during that session is marked "starting" but it never successfully starts. I've seen a lot of talk about the existence of "User Privilege Service" - it only seems to show up in services when something is wrong - but I've not been able to find an explanation of what it is, what it does, and what to do if it refuses to start.

Any help would be much appreciated.

Edit: Removed HijackThis log as further reading through the forum indicates it's not appropriate to post it in advance

A:Updating Windows And User Privilege Service

I'm unsure of the validity of the User Privilege Service. It doesn't appear anywhere on my XP VM - even when invoking the "Run As" command. My XP VM is fully updated, but does not have .NET 1.1 or .NET 2.0 installed.As search of the web doesn't reveal much about this service, nor does a search of the Microsoft KB.I'm guessing that it's malware or a service installed by some relatively obscure add-on program that you have running. I'd suggest running a free, online scan to ensure that your protection hasn't been compromised. Here's 2 that I use:http://safety.live.com (requires IE)http://housecall.trendmicro.comIf it turns out that it's an infection, try posting in this forum: http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/If not, then post back and we'll see what we can do.

Read other 1 answers
RELEVANCY SCORE 46

Versions 5.0 ? 7.0 of ESET Smart Security and ESET Endpoint Security products for Windows XP OS allow a low privileged user to execute code as SYSTEM by exploiting a vulnerability in the ESET Personal Firewall NDIS filter (EpFwNdis.sys) kernel mode driver also mentioned as Personal Firewall module: Build 1183 (20140214) and prior. This is a ?trusted value vulnerability? that can be triggered through a specific IOCTL with a specifically crafted buffer, to force the driver to validate an improper IOCTL.

https://www.portcullis-security.com...-downloads/security-advisories/cve-2014-4973/
 

A:Privilege Escalation In ESET Products For Windows

This was patched, wasn't it?
"27/06/2014 | Fix confirmed"
 

Read other 1 answers
RELEVANCY SCORE 42.8

Has anyone seen this temperary fix for the WMF problem in windows?

http://www.grc.com/sn/notes-020.htm

It sounds like it will save alot of headaches until Microsoft can fix the problem.

This might be a good sticky.
 

Read other answers
RELEVANCY SCORE 42.8

New Zero-Day Windows 8.1 Vulnerability
 
A Google security researcher, 'James Forshaw' has discovered a privilege escalation vulnerability in Windows 8.1 that could allow a hacker to modify contents or even to take over victims' computers completely, leaving millions of users vulnerable...A Microsoft spokesperson confirms the vulnerability and says that it’s already working on a fix
 

 

A:New Zero-Day Windows 8.1 Vulnerability

This will be the first of many of the year 2015 LOL.

Read other 7 answers
RELEVANCY SCORE 42.8

Hiya

Posted this in Web and Email as its about the Windows Shell, but can be exploited on the web.

The Windows Shell is responsible for providing the basic framework
of the Windows user interface experience. It is most familiar to
users as the Windows Desktop, but also provides a variety of other
functions to help define the user's computing session, including
organizing files and folders, and providing the means to start
applications.

An unchecked buffer exists in one of the functions that helps to
locate incompletely removed applications on the system.
A security vulnerability results because it is possible for a
malicious user to mount a buffer overrun attack and attempt to
exploit this flaw. A successful attack would have the affect
of either causing the Windows Shell to crash, or causing code
to run in the user's context.

Be default, this is not remotely exploitable. However, under
very unusual conditions, it could be exploited via a web page
- - specifically, if the user has installed an application with
custom URL handlers and then uninstalled that application, and
the uninstall failed to correctly remove the application
completely. An attacker could then attempt to levy an attack
by constructing an HTML web page that seeks to exploit the
vulnerability, and then posting it on their web site or
sending it by email.
Affected Software:

Microsoft Windows 98
Microsoft Windows 98 Second Edition
Microsoft Windows NT 4.0
Microsoft Windows NT 4.0 Terminal ... Read more

Read other answers
RELEVANCY SCORE 42.8

http://www.techweb.com/article/showArticle...mp;section=news...Security experts are warning of never-before-seen malware, dubbed Stuxnet, that spreads via USB drives, infecting PCs via an unknown -- aka zero-day -- Windows vulnerability. Unfortunately, the attack works even with AutoRun and AutoPlay disabled, and affects at least Windows 7 Enterprise Edition x86 operating systems...............Interestingly, the DLL is disguised as a device driver, which is what allows it to auto-load, thanks to the malware having a valid digital signature from Realtek Semiconductor, a legitimate company. Security researchers are anxious to learn how attackers got their hands on the digital signature, since such signatures are critical for differentiating good software from bad.As that suggests, "digitally signed malware is a nightmare for antivirus developers," said Aleks Gostev, a security expert at antivirus vendor Kaspersky Lab, in a blog post.Patching the vulnerability or vulnerabilities exploited by Stuxnet will likely require an operating system fix from Microsoft, rather than simply recalling Realtek's digital signature. "Recalling a certificate from a company like this simply isn't feasible -- it would cause an enormous amount of the software which they've released to become unusable," said Gostev. ........EDIT:http://blogs.technet.com/b/mmpc/archive/20...xnet-sting.aspxStuxnet uses the aforementioned .lnk technique to install additional malware compon... Read more

A:zero-day -- Windows vulnerability

Complementing the news:http://www.wilderssecurity.com/showthread.php?t=276994http://www.wilderssecurity.com/attachment....mp;d=1279012965http://krebsonsecurity.com/2010/07/experts...-shortcut-flaw/http://anti-virus.by/en/tempo.shtmlhttp://www.threatexpert.com/report.aspx?md...8d06c03f92d0c13http://www.virustotal.com/ru/analisis/1635...555c-1278661251http://www.virustotal.com/ru/analisis/0d8c...9198-1278584497

Read other 29 answers
RELEVANCY SCORE 42.8

My mother just emailed me in a panic. She heard a rumor that the code for xp, vista, and seven was leaked and is now "public", so now all Windows pcs are suddenly vulnerable to attacks. Anybody heard any new rumors like this?

A:New Windows vulnerability?

I've not heard any rumours about this, although it is probably true that you can find the code if you search for it. All OSes are vulnerable to attack if you don't have security installed - this means an upto date Anti-Virus program and an enabled firewall (Windows or a 3rd party).

Read other 9 answers
RELEVANCY SCORE 42.4

Hi all,I came across this and thought it may be usefull to a few people here on the forums, although if you use 16 bit applications you may want to keep this disabled:This security hole is said to affect 32bit Windows operating systemsA CRITICAL FLAW has been found in the Windows NT trap handler that makes all Windows machines wide open to hackers. The problem has been a feature of every Windows system for the last 17 years and no one has noticed. According to Full Disclosure, the security hole in Windows allows users with restricted access to escalate their privileges to system level. It can be done on all 32-bit versions of Windows from Windows NT 3.1 to Windows 7. This is not likely to bother consumers much, but corporate IT managers will be wetting themselves.And the removal instructions. Enabling the "Prevent access to 16-bit applications"1. Start2. Run (Windows key + R)3. Type gpedit.msc and press enter (Run as Administrator if need be) 4. Expand - Computer Configuration5. Expand - Administrative Templates6. Expand - Windows Components 7. Open - Application Compatibility section.8. Double Click 'Prevent access to 16 bit applications'9. Check Enabled10 Click Apply then OkHere is a screenshot to help those having any troubles: http://i24.photobucket.com/albums/c11/smak...6bitdisable.jpgSources:http://www.theinquirer.net/inquirer/news/1...nt-windows-flawhttp://www.neowin.net/news/microsoft-issue...s-vulnerability

A:17 year old Windows flaw discovered in Windows 7. How to close this security vulnerability

According to the same site microsoft had promised to patch the hole in security http://www.theinquirer.net/inquirer/news/1...osoft-patch-bug. I am afraid I am one of those people who just has automatic updates on and hardly checks to see what I am actually downloading. I guess if some person who shouldnt have admin access especially in a company or business was to get it this way microsoft would have to do a lot of explaining. Its amazing that only after 17 years this hole has been found.

Read other 1 answers
RELEVANCY SCORE 42.4

Hiya

Bit late but still catching up.

Standard security recommendations call for port 135 - the port
on which the RPC endmapper operates - to be blocked at the
firewall. If this were done, Internet-based attackers would not
be able to exploit this vulnerability

http://www.microsoft.com/technet/security/bulletin/ms01-048.asp

Regards

eddie
 

Read other answers
RELEVANCY SCORE 42.4

Oh come on! They said that there would have been a patch made today to fix a vulnerability for the Windows Sidebar and Gadgets, but just now I went on Windows Update and found none!

What's the hold-up, guys?

Maybe that's something that's been queued for Patch Tuesday, perhaps, but for now, it looks like Inspector Gadget is on his way out.

How many of you were following up the report on the findings of the gadgets vulnerability by hackers at Defcon?

Microsoft warns Windows users to disable features in light of security vulnerability

A:Windows Sidebar vulnerability

Google plans to stop igoogle. Alright, fine. Now this. I saw the report and then pretended I didn't see the report.

PS John is really mad about igoogle, maybe we shouldn't bring it up...

Read other 4 answers
RELEVANCY SCORE 42.4

Microsoft is investigating new public reports of a limited attack exploiting a vulnerability in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server Service Pack 4, Windows Server 2003 Service Pack 1, and Windows Server 2003 Service Pack 2. Microsoft Windows 2000 Professional Service Pack 4, Windows XP Service Pack 2, and Windows Vista are not affected... http://www.microsoft.com/technet/security/...ory/935964.mspxhttp://isc.sans.org/diary.html?storyid=2627

A:Vulnerability In Rpc On Windows Dns Server

More info on the Windows DNS RPC interface vulnerabilityhttp://isc.sans.org/diary.html?storyid=2633

Read other 2 answers
RELEVANCY SCORE 42.4

An unpatched problem with Windows applications is much worse than first thought, with hundreds of programs, not just 40, vulnerable to attack, a Slovenian security company said today."It was a shocking surprise," said Mitja Kolsek, CEO of Acros Security. "It appears that most every Windows application has this vulnerability.""We examined a bunch of applications, more than 220 from about 100 leading software vendors, and found that most every one had the vulnerability," said Kolsek. Acros built a specialized tool to help its researchers pinpoint which applications were vulnerable.http://www.computerworld.com/s/article/918...t?taxonomyId=17UPDATE : Microsoft has released a Fix-It tool to address the problem. This Fix-It tool will work only after installing the update KB2264107.

A:Almost every Windows program has 0-day vulnerability

More details are now available for this vulnerability which is now being called "Remote Binary Plant" bug.http://blogs.pcmag.com/securitywatch/2010/...emote_binar.phphttp://www.theregister.co.uk/2010/08/20/wi...execution_vuln/Researchers of ACROS security who discovered this bug in Windows have started a blog to follow this issue : http://acrossecurity.blogspot.com/Meanwhile, Microsoft has declined to release any patch for this vulnerability saying that this is not Windows problem but application specific problem.http://www.computerworld.com/s/article/918...s?taxonomyId=17

Read other 10 answers
RELEVANCY SCORE 42.4

Something else that 'may' be serious; http://www.kb.cert.org/vuls/id/181038

SANS org rates it as 'Yellow'; http://isc.sans.org/
 

Read other answers
RELEVANCY SCORE 42.4

What is the general thought on the need for a third party malware package with Windows 8/8.1?  Is the new operating system secure enough to not need any security package?  We're having this discussion on LinkedIn and I'm not getting any definite answers there.

A:Windows 8/8.1 malware vulnerability

Um...why don't you take a peek at the Win8 forum, I do believe you will see that yes, that operating system gets the nasties just like all the other Win operating systems. Would I have a computer without a third party malware package? Heck No! As they say around here...it's like taking a toss in the hay without your raincoat...nine months later...surprise surprise....

Read other 21 answers
RELEVANCY SCORE 42.4

I recently signed up for Windows live, mostly so I could chat with support staff at Microsoft rather than engaging in fruitless searches on their help sites, which always seem to resemble being caught in a Java glitch loop.

The MSN Group functions are closing down this weekend and migrating to Multiply.

Windows Linked Id allows contact through Windows Live Instant Messenger to a Hotmail account (chat) and other Windows Live functions.

Windows was having a lot of problems the past couple days, so many that apparently they put up some very amateurish looking message screens (they appeared to be legitimate). There were messages stating that some services were temporarily unavailable and the like.

During this time I noticed more domain changes than usual and difficulty (sometimes extreme) in accessing and using the Bleeping Computer site. Some of the domain changes were BC shifts from server to server, apparently, but others, for BC and for other sites, were to non-legitimate locations. Sometimes the WHOIS search pages had missing or faulty letters. Sometimes Web of Trust had a gray icon.

I am hoping this vulnerability is only temporary, or is it an inherent one to any linked id system?

A:Windows Live Vulnerability?

Some of the domain changes were BC shifts from server to server, apparently, but others, for BCI am not exactly sure what you have going on, but BC doesn't 'shift' from server to server.I use Windows Live Services for a ton of different things, like Live Mesh, the Calendar. Messenger, Sky Drive, Live Writer, and Office Live, and have had no issues over the last few days. If they do happen to have an issue, the user will get a page with a simple error that the site can not be reached. I do not know what your definition of 'amateurish looking message screens' means.During this time I noticed more domain changes than usual and difficulty What do you mean by this, and how do you know?I am hoping this vulnerability is only temporary,What vulnerability? There is no Windows Live Vulnerability. There have been some issues with the Messenger client, but that is really it. Windows Live is a whole range of services, web applications, and stand-alone apps. It is sort of like saying there is a vulnerability with the Internet.Sometimes the WHOIS search pages had missing or faulty letters. Which sites specifically returned problem results? We can't very well help if we can't try to reproduce the error.Honestly, with all the issues that you have been having, I would guess that you let someone into your system that you shouldn't of, and now it is time for a completer reformat.

Read other 1 answers
RELEVANCY SCORE 42.4

Zero-Day Vulnerability in Windows Shell dated July 17, 2010

Experts Warn of New Windows Shortcut Flaw dated July 16, 2010

-- Tom
 

A:Zero-Day Vulnerability in Windows Shell

don't hear about many viruses that target x64 based systems, but this one does. thx for the read
 

Read other 1 answers
RELEVANCY SCORE 42.4

After a Google researcher published the vulnerability and its working code on June 10th, Microsoft has confirmed that Windows XP and Windows Server 2003 contain an unpatched bug that could be used to infect PCs by duping users into visiting rigged Web sites or opening attack e-mail.The vulnerability lies in the HCP protocol used by the Help Center in Windows XP. Microsoft has not given a deadline to issue a patch. In the mean while, Microsoft has advised the Windows XP/2003 users to disable the HCP protocol.How to disable the HCP protocol using the automated Fix It tool : http://support.microsoft.com/kb/2219475

Read other answers
RELEVANCY SCORE 42.4

There's a serious Windoze security issue that's come up, what they call a 'zero day' exploit. It effects all machines running the Windows OS and effects up-to- date patched machines as well. Steve Gibson has a workaround posted on his site. Go here to check it out.
 

A:Serious Windows Security Vulnerability (what's new)

bump
 

Read other 1 answers
RELEVANCY SCORE 42.4

A new vulnerability has been found in regedit that allows keys of length greater than 255 characters to be hidden.More info can be found here:http://secunia.com/advisories/16560/A scanner for these types of long registry keys can be found here:http://isc.sans.org/LVNSearch.exe

Read other answers
RELEVANCY SCORE 42.4

Windows Wi-Fi vulnerability discoveredBy Tom EspinerPublished: January 16, 2006, 1:55 PM PST A Windows feature that automatically searches for Wi-Fi connections can be exploited by hackers...When a PC running Windows XP or Windows 2000 boots up, it will automatically try to connect to a wireless network. If the computer can't set up a wireless connection, it will establish an ad hoc connection to a local address...looking to connect with other computers...This would allow the two machines to associate together, potentially giving the attacker access to files on the victim's PC...news.com

Read other answers
RELEVANCY SCORE 42.4

Has Microsoft found a solution for the Windows 7 Aero Theme vulnerability yet? I want to go back to using it again.

A:Windows 7 Aero Vulnerability

This one? If so, came out a month ago.

Does SP1 patch the aero vulnerability from May?

Read other 1 answers
RELEVANCY SCORE 42.4

hello friends
I'm searching for Windows Vulnerability Scanner tools...
I know some but they are outdated or useless(Protector Plus, Secunia psi, Heimdal free,...)
I'm searching for smth like Vulnerability Scan in Kaspersky Total Security but can't find any:/
i found one:
Nessus Home
anyone know about this tool?

if you know more please tell me.
 

A:Windows vulnerability scanners?

I don't know abut Nessus, but for network mapping, i use a tool often used by hackers, so i won't mention it (smart people will surely see i did )
 

Read other 14 answers
RELEVANCY SCORE 42.4

Hiya

The Universal Plug and Play (UPnP) service allows computers to
discover and use network-based devices. Windows ME and XP include
native UPnP services; Windows 98 and 98SE do not include a native
UPnP service, but one can be installed via the Internet Connection
Sharing client that ships with Windows XP.

A vulnerability results because the UPnP service does not correctly
handle certain types of invalid UPnP requests. On Windows 98, 98SE,
and ME systems, receiving such a request could cause a variety of
effects ranging from slow performance to system failure. On
Windows XP, the effect is less serious as the flaw consists of a
memory leak. Each time a Windows XP system received such a request,
a small amount of system memory would become unavailable;
if repeated many times, it could deplete system resources to
the point where performance slowed or stopped altogether

Affected Software:

Microsoft Windows 98
Microsoft Windows 98SE
Microsoft Windows ME
Microsoft Windows XP
Note: Windows 98 and 98SE are only affected if the Internet Connection Sharing that ships with Windows XP has been installed on the machine.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms01-054.asp

Regards

eddie
 

Read other answers
RELEVANCY SCORE 42

yo shawn,

d'you know a cmd command for direct elevation instead of right-click>run as admin?

A:cmd elevation

Our tutorial on the subject. Seven and Vista would be the same

Elevated Command Prompt - Windows 7 Forums

Read other 2 answers
RELEVANCY SCORE 42

Tried logging in as a "non-admin" to a domain, and there are a lot of things that I can and can't do.

I can change IP settings, enable/disable NIC's, run an nslookup, but I can't run ipconfig /flushdns. Apparently I need to be elevated to run a flushdns.

I am not even given the option to enter a username/password.

I got this message trying to run a CMD window as the local administrator:

Attempting to start CMD as user "MEDIA-PC\administrator" ...
RUNAS ERROR: Unable to run - CMD
1311: There are currently no logon servers available to service the logon request.

How can there not be a logon server, when I am ON the "server" (aka local machine)...
 

A:elevation

The local "administrator" is disabled by default. You can "Run as administrator" with a different account that has local administrator privileges.
 

Read other 2 answers
RELEVANCY SCORE 42

I'm trying to do a ipconfig/flushdns. It wouldn't work. So i ran cmd.exe as an administrator, and it worked just fine. However, i found the fact that I had to do this a bit annoying, since i'm already an administrative user. I looked at the file permissions for cmd.exe and i noticed that the user "trustedinstaller" had more rights than administrator did, who had the same rights as the average user. How do I go about changing my access rights to those simmilar to trustedinstaller, or just change my classification to trustedinstaller all together? I don't want to have to find cmd.exe and run it as an admin, every time I want to do anything that might be "unwanted."

Would it be easier if i disabled windows defender?

Also, I would like to change it so that when I right click .html files, they open in firefox, but I would like the "edit" option to be notepad. I know how to do this in xp, and I know how to change overall file association in vista, but how do I change just the edit option in vista?
 

A:CMD elevation

bump?
 

Read other 2 answers
RELEVANCY SCORE 42

Does anyone know if there is a version of this out there that still works or has Microsoft already fixed this problem because if they havn't could you provide a download link. I need this so that I can have administrative ability in cmd to be able to use C:\Windows|System32>mkdir testl.

Read other answers