3 ms·
To the extent that "local-only" is a mitigating factor, it shouldn't be. Real intruders are likely to layer their attack; a network exploit to get in, maybe a l
by spacemanmatt 12y ago
To the extent that "local-only" is a mitigating factor, it shouldn't be. Real intruders are likely to layer their attack; a network exploit to get in, maybe a local-only privilege escalation to get deeper. They aren't picky.
- goldenkey 12y agoIt's a huge factor to a personal computer user. This exploit means almost nothing to those users because just having their single account jacked via a remote exploit is screwed enough. Privilege escalation is diddly squat. If we are talking about a corporate user, then it means a lot more.
- comex 12y agoThese days, having the IE renderer process running in the "protected mode" sandbox jacked is theoretically not "screwed enough"; I think this vulnerability would allow escaping from that sandbox. Correct me if I'm wrong, as I don't use Windows.
- goldenkey 12y agoYou might be right, I don't know much about the sandboxing. After a quick Google search, it seems like the details are sparse.