Windows XP update strange sentence?

[Whiffy]

I got an update a few days ago which said this....
"A security issue has been identified that could allow an
authenticated local
attacker to compromise your system and gain control over it."

Can you spot that there's something not quite right about this
sentence written by Microsoft or is it meant to be this way?

 

[Paul]

I got an update a few days ago which said this....
"A security issue has been identified that could allow an
authenticated local
attacker to compromise your system and gain control over it."

Can you spot that there's something not quite right about this
sentence written by Microsoft or is it meant to be this way?

Um. It's meant to sound scary, so you'll install it

Are you scared yet ?

See, here's another security bulletin...

http://www.lolcatpics.com/images/infridgeeating.jpg

Paul

 

[Kamarupa]

Um. It's meant to sound scary, so you'll install it

Are you scared yet ?

See, here's another security bulletin...

http://www.lolcatpics.com/images/infridgeeating.jpg

Paul

OWWWWWWWWWWWWWW !!
Please don't ever post such scary graphics again.
Scared the devil half out of me, perhaps permanently.
I am installing every Microsoft patch and update ever issued right away.
;-)

 

[Whiffy]

I hoped I'd not be the only one to notice the un- prefix. It normally
says "unauthenticated".

Why does it say "authenticated local attacker"?

.... surely any attacker is unauthenticated?

 

[Paul]

I hoped I'd not be the only one to notice the un- prefix. It normally
says "unauthenticated".

Why does it say "authenticated local attacker"?

... surely any attacker is unauthenticated?

It could imply an elevation of privilege, from a regular
user account, to Administrator.

Paul

 

[John John MVP]

I hoped I'd not be the only one to notice the un- prefix. It normally
says "unauthenticated".

Why does it say "authenticated local attacker"?

... surely any attacker is unauthenticated?

No, the attacker is logged on locally but a vulnerability could allow
him to perform actions with elevated privileges. For example, due to a
vulnerability a limited user might be able to run commands or programs
under guise of the System account or which only administrators should be
able to run, this logged on limited user is an authenticated local
attacker. This is called "token kidnapping" or "token kidnapping
privilege escalation".

John

 

[Iceman]

I got an update a few days ago which said this....
"A security issue has been identified that could allow an
authenticated local
attacker to compromise your system and gain control over it."

Can you spot that there's something not quite right about this
sentence written by Microsoft or is it meant to be this way?

To control what updates get installed on your computer, disable automatic
updates and switch to notification. Make a note of the KB number of all
updates on offer and then Google the numbers for further information.