CCE-36498-4| Platform: cpe:/o:microsoft:windows_server_2012::r2 | Date: (C)2015-10-08 (M)2023-07-04 |
Prohibit non-administrators from applying vendor signed updates
This setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor.
Non-administrator updates provide a mechanism for the author of an application to create digitally signed updates that can be applied by non-privileged users.
If you enable this policy setting, only administrators or users with administrative privileges can apply updates to Windows Installer based application.
If you disable this policy setting, users without administrative privileges will be able to install non-administrator updates.
Parameter:
[enable/disable]
Technical Mechanism:
(1) GPO: Computer ConfigurationAdministrative TemplatesWindows ComponentsWindows Installer!Prohibit non-administrators from applying vendor signed updates
(2) REG: HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsInstaller!DisableLUAPatching
| CCSS Severity: | CCSS Metrics: |
| CCSS Score : 4.4 | Attack Vector: LOCAL |
| Exploit Score: 0.8 | Attack Complexity: LOW |
| Impact Score: 3.6 | Privileges Required: HIGH |
| Severity: MEDIUM | User Interaction: NONE |
| Vector: AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H | Scope: UNCHANGED |
| | Confidentiality: NONE |
| | Integrity: NONE |
| | Availability: HIGH |
| | |
References: | Resource Id | Reference |
|---|
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:27513 |
