Am in the process of documenting how to install a new remote access solution across (our granted somewhat small) user base. During the install of the client on XP the program asks to be given access to the hosts file. This is fine by me so far. The trouble is that it does not just grant it to an administrator or single user but the Group\Everyone. Upon a reboot I ran an Effective Permissions test on the hosts file for the Guest account and low and behold it now has Full control of the hosts file.
My manager does not think this is overly concerning as it has not been listed as a vulnerability for the product we are using. I am a touch more cautious about it though especially as we are asking the users to do this on their home PCs.
Is having the Group\Everyone with full control to the hosts file a hugely worrying security hole?