"for the problem to be exploited, it has to be an inside job and the attacker must have valid log-on credentials on the target system and be able to log on locally, or must already have code running on the target system"

Is social engineering an application that users (most who run as administrators) download and execute an "inside job"? I hope those harmed by this exploitation of Microsoft's sloppy coding get together for a nice class action lawsuit. And perhaps people will start reconsidering the wisdom of paying so much to a company with lax security practices which tries to limit its liability via a draconian EULA.