Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

Does this vulnerability mean that a user could change the registry values that specify RASMANs parameters?

April 26, 2017mean parameters rasman Registry specify user values vulnerability

0

Posted

Does this vulnerability mean that a user could change the registry values that specify RASMANs parameters?

1 Answer

0

Posted

Not directly. Keep in mind that registry entries are objects, and have their own permissions. The permissions on RASMAN’s registry entries are correct, and would not allow a normal user to change them. However, because of the inappropriate DACL in RASMAN’s security descriptor, a malicious user could achieve the same effect by using the Service Control Manager to change the RASMAN parameters.