due to the USERS group with read/execute on the C drive, any cgi script on any website can run any exe from windows folder.
It is not possible to remove the USERS group from C drive, as this causes problems with windows updates and other issues I suspect.
All websites run under their own user context, and all those users are a member of WSP_ISURS, so I thought I could just deny that GROUP access to windows folder, but that also does not work as you cannot change permissions on windows folder.
Can anyone tell me what is the solution to restrict access to C drive so cgi scripts, asp.net etc cannot do this ?
↧