Slashdot Mirror

← Back to Stories (view on slashdot.org)

"Very Severe Hole" In Vista UAC Design

Posted by kdawson on from the she-said-he-said dept.

Cuts and bruises writes "Hacker Joanna Rutkowska has flagged a "very severe hole" in the design of Windows Vista's User Account Controls (UAC) feature. The issue is that Vista automatically assumes that all setup programs (application installers) should be run with administrator privileges — and gives the user no option to let them run without elevated privileges. This means that a freeware Tetris installer would be allowed to load kernel drivers. Microsoft's Mark Russinovich acknowledges the risk factor but says it was a 'design choice' to balance security with ease of use."

2 of 813 comments (clear)

  1. Tetris is a brand name by tepples · · Score: -1, Offtopic

    From the blurb: "This means that a freeware Tetris installer would be allowed to load kernel drivers."

    Point of terminology: Except for one PC DOS based prototype by Vadim Gerasimov, Tetris software is not freeware. Calling Quadra, Lockjaw, Bedter, or Emlith "Tetris" is just as incorrect as calling RC Cola or Coca-Cola "Pepsi" or calling GNU "UNIX", because it's not.

    </anal-retentive>

    Corrected: "This means that a freeware Soviet Mind Game installer would be allowed to load kernel drivers."

  2. Why is Intel making 80 core CPU's? by Anonymous Coward · · Score: -1, Offtopic

    Microbucks has requested they need 79 to do security checks.