Home page logo  fulldisclosure logo Full Disclosure mailing list
archives  Re: Question for the Windows pros From: Bernhard
Mueller <research () sec-consult com> Date: Thu, 19 Jan 2006
08:20:37 +0100   The ImpersonateClient API does not require that
credentials are embedded into the program. A call to
ImpersonateClient allow a server to "impersonate" the client
when it receives a local connection, e.g. via a named pipe. It
is mostly used by servers to DROP their privileges to that of
the connecting user if they are running with administrative A
security issue with ImpersonateClient arises if there's no error
checking on the ImpersonateClient call and the process runs
without realizing that it is still SYSTEM. Another issue would
be an unprivileged client with the ImpersonateClient privilege,
if an attacker manages to make a process with admin rights
connect to that client. This is why normal users do not have
this right by default.    Paul Schmehl wrote: --On Wednesday,
January 18, 2006 17:07:23 -0600 Frank K