[JIRA] (SSPCPP-961) Shibboleth SP - Windows - possible Privilege Escalation

[Rod Widdowson (Jira)]

Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 ) *commented* on SSPCPP-961 ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiM2MyZmNmNzE4ZGFhNGFkMWFiNGE5ZmFmNzg2MmM3NzkiLCJwIjoiaiJ9 )

Re: Shibboleth SP - Windows - possible Privilege Escalation ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiM2MyZmNmNzE4ZGFhNGFkMWFiNGE5ZmFmNzg2MmM3NzkiLCJwIjoiaiJ9 )

The answer is “I don’t know”. In my toy installation IIS runs as a distinguished user which may or may not inherit from USERS. I suspect my best job is to resussitate my IIS install and see what happens when I update to this version. If it doesn’t then I’ll need to get cute and add IIS_APPOOL to the people with READ permission. I hate programming by experimentation but IIS is so configurable the best we can do is make it work for my default install.

Note that my Apache instance works because httpd runs as LocalSystem.

( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiM2MyZmNmNzE4ZGFhNGFkMWFiNGE5ZmFmNzg2MmM3NzkiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiM2MyZmNmNzE4ZGFhNGFkMWFiNGE5ZmFmNzg2MmM3NzkiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100210- sha1:9b34d7c )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/aae5714c/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-0ce6e0a9-d8b7-496a-bc55-6f8c1f865009
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/aae5714c/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-18623160-5385-45f8-a972-8fe234bfb8e1
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/aae5714c/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-c08a3068-1554-4928-92bf-111cb7001643
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/aae5714c/attachment-0005.png>