The details of an apparent flaw in Windows Vista's UAC functionality were revealed yesterday. The flaw was found by eEye and originally reported to Microsoft on January 19th. With Vista's User Account Control feature, Windows users have limited system privileges by default. In order to get system, or administrator, level privileges, a user must provide appropriate credentials. The vulnerability allows a local user to permanently increase their privileges to the admin level. As of today, Microsoft has not issued a patch. But maybe this is not a security flaw in Vista at all. "What?!?", you say?
Well, Microsoft Technical Fellow Mark Russinovich says that flaws in UAC can't be considered security flaws. Whoa, maybe he's been taking verbiage lessons from former President Clinton; e.g. "it depends on what your definition of security is."
We certainly think of UAC as a security measure. In our own WindowZones product, we assume, as does Microsoft's own Group VP Jim Allchin, that most users of Windows XP use a logon account that is an administrator account. WindowZones allows you to strip away from Internet-facing applications all of the administrator rights, which substantially reduces your exposure and any resulting impact from Internet threats - especially new ones known as "zero-day" attacks.
It will be interesting to see what the future holds for UAC in Windows Vista.
-AllenN
Comments