03.73.2006 - MS06-011: Permissive Windows Services DACLs Could Allow Elevation of Privilege (914798)

A privilege elevation vulnerability exists on Windows XP Service Pack 1 on the identified Windows services where the permissions are set by default to a level that may allow a low-privileged user to change properties associated with the service. On Windows 2003 permissions on the identified services are set to a level that may allow a user that belongs to the network configuration operators group to change properties associated with the service. Only members of the Network Configuration Operators group on the targeted machine can remotely attack Windows Server 2003, and this group contains no users by default. The vulnerability could allow a user with valid logon credentials to take complete control of the system on Microsoft Windows XP Service Pack 1. - Download Microsoft Windows XP Service Pack 1 (SP1)Update - Download Microsoft Windows Server 2003 Update - Download Microsoft Windows Server 2003 for Itanium-based Systems Update - View Microsoft Security Bulletin MS06-011 - View Microsoft Knowledge Base Article - 914798 - Visit Microsoft Corporation