Stefano Demiliani WeBlog

New Windows Flaw?

Just read on SecurityTracker... Windows XP Kernel NtSystemDebugControl() Flaws Let Local Users With SeDebugPrivilege Execute Arbitrary Code in Kernel Mode.

You can read all details on the link previously signaled. The impact of this flaw is that a local user with the SeDebugPrivilege privilege can execute arbitrary code with kernel mode privileges to take full control of the system. Terrible!

I think too much flaws are discovered on Microsoft Systems in these days and this is not good... We can't patch a system every day, it's too much. Maybe all the MS attention now is on Longhorn and this is a big error... Longhorn is not the present, is the future... and if the future OS will be great (maybe!) the actual OS have too much flaws that gives more and more attention.

Now I can understand why a lot of people wants to migrate to other OS! :(

UPDATE:

There's a correction that I post here as is:

The "flaw" on http://www.securitytracker.com/alerts/2004/Feb/1009128.html is not really a flaw since any account with SeDebugPrivilege privilege is able to open, modify the address space of,and inject a thread into any process on the system.
That capability alone lets a user with SeDebugPrivilege privilege compromise processes such as the Local Security Authority Subsystem (LSASS) running in more privileged accounts. A compromised privileged process could be made to do anything on behalf of the user, like add other privileges or groups to the user's account or load an arbitrary device driver, for example.
 
 -Mark Russinovich
Sysinternals.com