Microsoft Windows Impersonation Privilege Escalation Weakness

Microsoft Windows Impersonation Privilege Escalation Weakness

Microsoft Windows is susceptible to a weakness that may allow attackers to gain elevated privileges. This issue is due to the ability of services to impersonate clients after they have authenticated.

Microsoft encourages the use of the 'Local Service' and 'Network Service' accounts to mitigate the consequences of exploiting vulnerabilities in services. Attackers exploiting latent vulnerabilities in services running with these low-privilege accounts may take advantage of this weakness to gain elevated privileges.

Under certain circumstances, this issue may aid attackers who can exploit latent vulnerabilities in low-privileged services in gaining elevated privileges, allowing them to fully compromise targeted computers.

This issue is similar to the one documented in BID 8276 (Microsoft SQL Server / MSDE Named Pipes Privilege Escalation Vulnerability).LoadDocument.aspx?guid=4E4FB9BA810E48B186E99FAFC7E3462C