We found a surprising result: commercial software from major vendors routinely has user-to-administrator privilege-escalation vulnerabilities that result not from buffer overruns (or other bugsinside the software) but just from misconfigurations of permissions and registry entries.
