Hackers Handbook - Millenium Edition/Hackers Handbook.iso/library/hack99/msie_5_0_setup_wizard.txt

Text File | 1999-03-26 | 7.0 KB | 178 lines

Tue, 23 Mar 1999 11:41:24 +0200
Thor Kottelin <[e-mail]>
Windows NT BugTraq Mailing List <[e-mail]>
Thor Kottelin <[e-mail]>
MSIE 5 installer disables screen saver


After running the MSIE 5 installation wizard ie5setup.exe on two separate
NT 4.0 SP4 machines - one Workstation, one Server - my screen saver (Logon
Screen Saver, password protected) no longer kicks in. The screen saver tab
in the Display control panel states "None". I have gone through the motions
twice, thus reproducing the problem on both systems. The screen saver selection
seems to disappear when starting to download files, and on one occasion it
has reappeared after I cancelled the download immediately after starting it.

This seems like a serious problem which could leave sensitive systems open
to console abuse.

Thor

-- [e-mail]

--------------------------------------------------------------------------

Tue, 23 Mar 1999 12:02:19 +0200
Thor Kottelin <[e-mail]>
Windows NT BugTraq Mailing List <[e-mail]>
Thor Kottelin <[e-mail]>
Re: MSIE 5 installer disables screen saver


Thor Kottelin wrote:
>
> After running the MSIE 5 installation wizard ie5setup.exe on two
> separate NT 4.0 SP4 machines - one Workstation, one Server - my screen
> saver (Logon Screen Saver, password protected) no longer kicks in.

I finally managed to finalize the installation on one of the machines, the
Workstation. Before beginning the actual installation. I made sure the
screen saver was enabled. After starting the installer, i.e. while it was
running, the screen saver was again disabled. After the installer had
completed and I had rebooted the machine, the screen saver was back
though. It thus seems that this problem might be really relevant only
when the installation is aborted, such as when the installer is unable
to connect to the download sites.

Thor

-- [e-mail]

--------------------------------------------------------------------------

Date: Tue, 23 Mar 1999 11:27:21 -0500
From: Russ <[e-mail]>
To: [e-mail]
Subject: Re: MSIE 5 installer disables screen saver

I just wanted to confirm Thor's observations. I have seen precisely the
same behavior on my SP4 and SP5 machines. The screen saver (it doesn't
matter which one you use) is disabled by the IE Setup Wizard as soon as
you select which download server you are going to use. It stays disabled
until the download completes, or, is canceled or aborted. Like Thor, I
was attempting to download the files, not do an interactive installation
(I don't know if that accounts for the one report I received saying it
didn't happen on their SP4 box).

Dare I say that this is yet another example of a lack of thought by MS
when it comes to IE and Servers? The list continues to grow. This gets
added to;

- inability to install IE without VDOLive and Microsoft Music Control on
a mission critical server.
- inability to avoid rebooting to upgrade IE with an SP.
- inability to avoid installing OE.
- inability to simply upgrade the components already installed on a
machine (like the NT SPs work).

Sure, IEAK can solve some of these problems, but the basic installation
of IE itself should have these options included, IMNSHO.

Cheers,
Russ - NTBugtraq moderator

--------------------------------------------------------------------------

Date: Tue, 23 Mar 1999 12:55:29 -0500
From: Russ <[e-mail]>
To: [e-mail]
Subject: Re: MSIE 5 installer disables screen saver

Correction, "IE 5.0 Setup Wizard also disables/pauses the Task Manager
(if present)" should have read;

"IE 5.0 Setup Wizard also disables/pauses the Task Scheduler Service (if
present)"

Apologies for any confusion.

Cheers,
Russ - NTBugtraq moderator

-----Original Message-----
>From: Russ [mailto:[e-mail]]
Sent: Tuesday, March 23, 1999 12:35 PM
To: [e-mail]
Subject: Re: MSIE 5 installer disables screen saver


<tirade>
I'm going to editorialize here for a moment, but I think this issue
needs some emphasis.

Dimitry Andric <[e-mail]> reported that, in addition to the screen
saver being disabled, IE 5.0 Setup Wizard also disables/pauses the Task
Manager (if present).

Now this is some serious stuff here. There's nothing in the IE 5.0 Setup
Wizard panels or help that indicates any of this is going to happen.
<http://www.microsoft.com/windows/ie/download/instruct.htm> makes no
mention of it either.

Let's put aside, for the moment, the idea of installing IE on a Server
(since so many of you feel this is just a Bad Thing(tm) in the first
place).

Instead, let's focus on the idea that a password protected screen saver
may be part of a corporate security policy. The fact that a program, any
program, would disable this for any reason, or any duration, without
forewarning the user makes me think of a criminal act. MS is obviously
doing this to ensure the fastest download possible, and that's a
laudable goal, but not without informing the user that its going to
happen.

Couple that with the disabling/pausing of the Task Manager, thereby
causing scheduled jobs to be skipped (and who knows how critical those
jobs might be), and you might come to the same conclusion as me. Namely,
this isn't a benefit for the end user, its a benefit for Connexion or MS
or whomever is trying to provide the download.

MS rides shotgun over the user's system, arbitrarily changing settings
and disabling functions without informing the user. Now if I were doing
an interactive installation, I might understand why some things need to
be disabled in order for the installation to complete successfully (like
it is with the installation of many services). But when all I'm trying
to do is download the components for an installation later at a more
appropriate time, why would I think anything would be stopped on my
machine?

As Microsoft, and other vendors, move further towards on-line
distribution of software components...this problem, if not rectified,
will only become worse.

- If anything is going to alter my security policy, I should be asked
first to confirm it should do so.

- If anything is going to disable/pause a service, I should be asked
first to confirm it should do so.

Anything less is tantamount to a malicious act being performed on my
machine, no different than a DoS invoked remotely by a malicious hacker.
Strong words, I realize, but if their interest in getting me off of
their download site as fast as possible overrides my interest in the
operation of my system, you can bet my words are going to be strong!

They can talk all they want about the support issues surrounding the
downloading of software, none of that gives them the right to alter my
system's operational parameters without asking me first, especially when
all I want to do is download files.

All they had to do was put up a big warning box that explained precisely
what they were going to do to my system to effect a faster, more
efficient, download. The fact they didn't is a big problem!

Cheers,
Russ - NTBugtraq moderator
</tirade>