[Dinsdale]

they would outlaw stupidity.

Carefull what you wish for...MS has done some awfull stupid things.

They should replace the default paste message handlers for any controls that are part of an app that will be running as admin (frequently SQL server for example). Short of that they need to build a mechanism for checking callback addresses (no callbacks across application boundries, which should be verboten to begin with).

[sourcery]

Execution of an "external" callback (one that is permitted to cross an application boundary) should occur using the privileges of the application that specified/provided the callback address, instead of using the privileges of the caller. Disallowing all callbacks that cross application boundaries would be too restrictive.

[eno_]

Correct. You have the legacy of the weak-protection Win95 model infecting the NT code base here. No reason why it should be so fully backward compatible, and MS has made bigger changes before. Anyone coding using modern class libraries wouldn't do this kind of thing. So yes it would be painful to fix, but not impossible.

Also, if I were running IT for a foreign government, I would ban Windows because I could count on MS sharing this info with U.S. netional security. It's just too tempting for the NSA not to be beavering away at sploits that take advanatge of secret holes.