Message: 5
Date: Mon, 30 May 2005 23:00:31 +0200
From: "Pif Gadget" <pif.gadget@hotmail.fr>
Subject: [Full-disclosure] [Windows XP] possible privilege escalation
To: full-disclosure@lists.grok.org.uk
Message-ID: <BAY15-F3220DF3378A390192D4C02FF030@phx.gbl>
Content-Type: text/plain; charset=iso-8859-1; format=flowed
Hello,
I've encountered twice a strange problem on my Windows XP SP2 (fully
patched) box.
[...]
Today, being logged in the simple user account and having Windows
Media Player launched, I executed an installation executable file
(from Microsoft) as Administrator using "Execute as..." entry in the
contextual menu. The application was successfuly installed. Later, I
tried to close Windows Media Player, the window was closed but the
music was still playing. I looked in the Task Manager in order to
force quit WMP, but to my surprise the task (wmplayer.exe) did not
belong to me ("simple user"), but to Administrator (It's worth
mentioning that the Administrator account was not open at that moment
- as it is possible with User Fast Switching, so no other instance of
WMP was running.)
What is even more strange is that you quit wmplayer.exe yet it was still
running in the background with higher privileges. I tried to reproduce this
but have failed. Can you provide more information such as which software
from MS you tried to install and which version of Windows Media player you
have installed.
Cosmin Stejerean
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
