[JIRA] (SSPCPP-961) Shibboleth SP - Windows - possible Privilege Escalation

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on SSPCPP-961 ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiNjQ5MmI3NTE2NzU4NGYxMmIzMmJhZjA4NDY3ZjQwY2YiLCJwIjoiaiJ9 )

Re: Shibboleth SP - Windows - possible Privilege Escalation ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiNjQ5MmI3NTE2NzU4NGYxMmIzMmJhZjA4NDY3ZjQwY2YiLCJwIjoiaiJ9 )

I definitely did not think IIS ran as Admin, that is odd. I was definitely not interested in the general case, just the default user it installs with. and making sure that had read access.

Obviously if it runs as Admin that’s nuts, but it’s not our problem, it just illustrates why I’m not treating this as a security issue to begin with, servers are inherently single use now, have been for many years.

( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiNjQ5MmI3NTE2NzU4NGYxMmIzMmJhZjA4NDY3ZjQwY2YiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiNjQ5MmI3NTE2NzU4NGYxMmIzMmJhZjA4NDY3ZjQwY2YiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100210- sha1:9b34d7c )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/93e79c9d/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-fd5f1b14-e9dc-4734-86c5-2db24a1ba598
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/93e79c9d/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-ae9a6c70-83e5-4d88-ad19-452a488ed0e6
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/93e79c9d/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-a60fc472-a44f-447c-a184-17a5c6213d5c
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/93e79c9d/attachment-0005.png>