Re: [Full-disclosure] Defense in depth -- the Microsoft way (part 8): execute everywhere!

2013-08-26 Thread Heavenly Avenger
h" without so much personal thought put in. -Original Message- From: James Lay Sent: Monday, August 26, 2013 12:16 pm To: bugtraq@securityfocus.com Subject: Re: [Full-disclosure] Defense in depth -- the Microsoft way (part 8): execute everywhere! On Sat, Aug 24, 2013 at 5:32 PM,

Re: [Full-disclosure] Defense in depth -- the Microsoft way (part 8): execute everywhere!

2013-08-26 Thread James Lay
On 2013-08-24 16:33, Jeffrey Walton wrote: Hi Stefan, ... administrative rights for every user account Hmmm... XP/x64 appears to have a bug such that the second user also needs to be admin (perhaps XP/x86, too). XP does not recognize the first account as admin, so the second account cannot be

Re: [Full-disclosure] Defense in depth -- the Microsoft way (part 8): execute everywhere!

2013-08-26 Thread James Lay
On Sat, Aug 24, 2013 at 5:32 PM, Stefan Kanthak wrote: Hi, since it's start about 20 years ago Windows NT supports (fine grained) ACLs, including the permission "execute file". In their very finite wisdom Microsoft but decided back then to have this permission set on EVERY file a user create

Re: [Full-disclosure] Defense in depth -- the Microsoft way (part 8): execute everywhere!

2013-08-26 Thread Stefan Kanthak
Jeffrey Walton wrote: > Hi Stefan, > >> ... administrative rights for every user account This WAS the default for user accounts back then, and still IS the default for user accounts created during setup. > Hmmm... XP/x64 appears to have a bug such that the second user also > needs to be admin (

Re: [Full-disclosure] Defense in depth -- the Microsoft way (part 8): execute everywhere!

2013-08-26 Thread Jeffrey Walton
Hi Stefan, > ... administrative rights for every user account Hmmm... XP/x64 appears to have a bug such that the second user also needs to be admin (perhaps XP/x86, too). XP does not recognize the first account as admin, so the second account cannot be limited (at least on my test box). Vista and

Defense in depth -- the Microsoft way (part 8): execute everywhere!

2013-08-26 Thread Stefan Kanthak
Hi, since it's start about 20 years ago Windows NT supports (fine grained) ACLs, including the permission "execute file". In their very finite wisdom Microsoft but decided back then to have this permission set on EVERY file a user creates (and assumes it is set on local and remote file systems wh