Windows shell vulnerability requires nothing more than forgotten quotes

by
Anonymous Coward
in security on (#2T7S)
Windows SysAdmins: before you laugh yourself to sleep over all those Linux systems struggling to patch Shellshock vulnerabilities, a recently discovered flaw in Windows Powershell allows similar privilege escalation with very little work. The recently discovered vulnerability relies upon:
a simple coding error-allowing untrusted input to be run as a command. In the current incarnation of the exploit, an attacker appends a valid command onto the end of the name of a directory using the ampersand character. A script with the coding error then reads the input and executes the command with administrator rights.
Seems if mankind can make it, mankind can also break it. Keep those systems patched, folks!
Post Comment
Subject
Comment
Captcha
What is the 4th digit in 7180376?