Re: [VulnDiscuss] Named Pipe Filename Local Privilege Escalation

On Tue, 8 Jul 2003, Slighter, Tim wrote:

 > Has @Stake conducted any extensive research on the potential impact on
 > production systems when implementing SP4?  Care to share these with the
 > mailing list please?

We have not done any research on the impact of SP4 on production 
systems.  We are not set up to do application regression testing.  This 
is a major change for applications that must use impersonation.  A with 
all service packs acceptance testing is advised. The Microsoft KB 
article (http://support.microsoft.com/default.aspx?scid=kb;[LN];821546) 
does have troubleshooting tips for applications that require the 
impersonation privilege that are not started by the service control 
manager or the COM infrastructure. 

It should be noted that this new privilege (SeImpersonatePrivilege) is 
not available in XP or NT 4.0. So this would dictate that SQL Server 
should be run on Windows 2000 SP4 or Windows 2003.

-Chris