CCE-2167-5| Platform: cpe:/o:microsoft:windows_xp | Date: (C)2012-03-13 (M)2023-07-04 |
This policy setting allows a process to assume the identity of any user and thus gain access to the resources that the user is authorized to access.
Countermeasure:
Restrict the Act as part of the operating system user right to as few accounts as possible-it should not even be assigned to the Administrators group under typical circumstances. When a service requires this user right, configure the service to log on with the Local System account, which has this privilege inherently. Do not create a separate account and assign this user right to it.
Potential Impact:
There should be little or no impact because the Act as part of the operating system user right is rarely needed by any accounts other than the Local System account.
Parameter:
[list_of_users_followed_by_comma]
Technical Mechanism:
(1) GPO: Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Act as part of the operating system
(2) REG: ###
(3) WMI: root\\rsop\\computer#RSOP_UserPrivilegeRight#AccountList#UserRight='SeTcbPrivilege' and precedence=1
| CCSS Severity: | CCSS Metrics: |
| CCSS Score : 7.0 | Attack Vector: LOCAL |
| Exploit Score: 1.0 | Attack Complexity: HIGH |
| Impact Score: 5.9 | Privileges Required: LOW |
| Severity: HIGH | User Interaction: NONE |
| Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | Scope: UNCHANGED |
| | Confidentiality: HIGH |
| | Integrity: HIGH |
| | Availability: HIGH |
| | |
References: | Resource Id | Reference |
|---|
| SCAP Repo OVAL Definition | oval:gov.nist.usgcb.xp:def:162 |
| BITS Shared Assessments SIG v6.0 | BITS Shared Assessments SIG v6.0 |
| Jericho Forum | Jericho Forum |
| HIPAA/HITECH Act | HIPAA/HITECH Act |
| FedRAMP Security Controls(Final Release Jan 2012)--LOW IMPACT LEVEL-- | FedRAMP Security Controls(Final Release Jan 2012)--LOW IMPACT LEVEL-- |
| ISO/IEC 27001-2005 | ISO/IEC 27001-2005 |
| COBIT 4.1 | COBIT 4.1 |
| GAPP (Aug 2009) | GAPP (Aug 2009) |
| NERC CIP | NERC CIP |
| NIST SP800-53 R3 | NIST SP800-53 R3 AC-3 |
| NIST SP800-53 R3 | NIST SP800-53 R3 CM-6 |
| PCIDSS v2.0 | PCIDSS v2.0 |
| FedRAMP Security Controls(Final Release Jan 2012)--MODERATE IMPACT LEVEL-- | FedRAMP Security Controls(Final Release Jan 2012)--MODERATE IMPACT LEVEL-- |
| BITS Shared Assessments AUP v5.0 | BITS Shared Assessments AUP v5.0 |
