Originally posted here by Nokia
If you can cause something to execute a peice of code, surley thats a security risk?
Not really. It depends alot on other things.

1st: As said there's no privilege elevation involved here. Everything that gets executed would have the same privileges as the user executing it. So why not execute your code directly?

2nd: If you've restricted what kind of executables a user can run you may have something to execute code of your choice. BUT no (regular) user should have a need for regsvr32 so why permit it?


What says the code you ftp'd cant make an account with admin privilages??
Because the (regular) user running the exploit doesn't gain any extra privileges (i.e. isn't allowed to create accounts) this would be impossible. Unless the code contains something to elevate the privileges but then again you could run that directly so why overflow?