Linked by Thom Holwerda on Sat 31st Jan 2009 10:45 UTC
Privacy, Security, Encryption Yesterday, we reported on the security flaw in Windows 7's UAC slider dialog, and today, Microsoft has given a response to the situation, but it doesn't seem like the company intends to fix it. "This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level." I hope this reply came from a marketing drone, because if they intend on keeping this behaviour as-is in Windows 7 RTM, they're going to face a serious shitstorm - and rightfully so. Let's hope the Sinfoskies and Larson-Greens at Microsoft rectify this situation as soon as possible.
Thread beginning with comment 346375
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[6]: Not that serious
by Nelson on Sat 31st Jan 2009 15:07 UTC in reply to "RE[5]: Not that serious"
Nelson
Member since:
2005-11-29

VBScript must be executed within the host environment. Every browser has provisions to protect from script propagation as well.

However, the bigger picture, and point alluded to by many, is that this can be bundled with malware, malware will not run without user elevation, so a lot of the danger is a moot point.

The dangerous possibility was the fact that this could be remotely executed with no privileges what so ever, and be used to disable UAC from outside the computer. This is not the case.

Reply Parent Score: 0

RE[7]: Not that serious
by MamiyaOtaru on Sun 1st Feb 2009 07:46 in reply to "RE[6]: Not that serious"
MamiyaOtaru Member since:
2005-11-11

However, the bigger picture, and point alluded to by many, is that this can be bundled with malware, malware will not run without user elevation

Unless the malware starts out by running the script, which is the whole point you seem to be missing. An installer can run this script, which disabled UAC, without a UAC prompt! Then the installer can proceed to do whatever it wants with no UAC prompts, as it has been disabled.

Reply Parent Score: 2