text_combined: allan jensen listssnotboblenet 5 sep 2002 richard bartlett wrote richard customer developing printer driver code allow custom driver settings nup booklet duplex etc saved server retrieved users data written printer driver using logged users authentication registry key hklmsystemcurrentcontrolsetcontrolprintenvironmentswindows nt x86driversversion3driver namecustom keysubkey let get straight registry key loaded server onto client workstations modify write back onto servers registry going use question security risks allowing users write key data string data form delimited numeric values data retrieved capable printer drivers interpreted risks see twofold 1 risks compromise server using registry key think unlikeley server use data client pcs unless someone knows way travel hive registry bypassing permissions set using regedt32 reason write registry key server server using dont think worry much someone travelling hive im curious driver actually modifies keys server 2 risks compromise client far likely would probably malformed extremely long string key value would presumably lead either dos system compromise buffer overflow client system client writes key back onto server yes theres wide open something nasty two things spring mind 1 anyone modify key make sure two users overwriting key thereby causing undesirable effects 2 anyone permissions write key anyone create thousands extra keys key thereby filling registry result thing obvious got wrong id happy clarify bit tell might misunderstood med venlig hilsen best regards allan jensen si hoc signum legere potes operis boni rebus latinus alacribus et fructuosis potiri potes tue 17 sep 2002 145123 0200 cest risks client systems writing server registry