Defense in depth — the Microsoft way (part 41): vulnerable by (poor implementation of bad) design

Posted by Stefan Kanthak on Jul 25

Hi @ll,

Windows 7 introduced the “Deployment Image Servicing and Management”
tool DISM.exe; this command line program is called for example by
its predecessor PkgMgr.exe (a GUI program which requests elevated
privileges), or by Windows Update (which runs under SYSTEM account).

DISM.exe needs to be run with administrative privileges:
this condition is met in both cases named above.

When called with valid arguments, DISM.exe creates a…