[JIRA] (SSPCPP-961) Shibboleth SP - Windows - possible Privilege Escalation

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on SSPCPP-961 ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiOWU5NzMwYjhmY2IwNDMxYmJjNWZhMWFmODRkNmE3ZmMiLCJwIjoiaiJ9 )

Re: Shibboleth SP - Windows - possible Privilege Escalation ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiOWU5NzMwYjhmY2IwNDMxYmJjNWZhMWFmODRkNmE3ZmMiLCJwIjoiaiJ9 )

We don’t do CVEs, but even if we did, we do not see this as a security issue, it was a documentation mistake that we corrected. That’s why I asked for it to be filed as a public bug, we’re not hiding it.

We consider the ACLs a best effort thing. It’s a good idea to do it but it’s nothing you should depend on, that’s always going to be a local issue to deal with. We’re not opening up any attacks here, we’re simply not (to this point) doing anything concrete to prevent them.

Reasonable people can differ but that is the official position of the project. If it were remotely exploitable that would be a totally different scenario obviously.

( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiOWU5NzMwYjhmY2IwNDMxYmJjNWZhMWFmODRkNmE3ZmMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiOWU5NzMwYjhmY2IwNDMxYmJjNWZhMWFmODRkNmE3ZmMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100210- sha1:9b34d7c )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221116/b68e8727/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-b63c8b7f-4865-44c8-96f6-8dee2d815ae3
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221116/b68e8727/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-1d4f29b1-53a5-4df6-a874-bf464857c3fc
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221116/b68e8727/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-430503fa-421a-4269-89fd-6267c47c5bfb
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221116/b68e8727/attachment-0005.png>