Without a plugin? A headache. WPMU upgrades often, recently twice in the same week. That's a lot of do-over if editing core files. Bad idea IMHO.
You'll need 2 plugins: one to fix future blogs when created and one to fix blogs that already exist.
First, you could edit a plugin and add default capabilities to New Blog Defaults, for example. The array of WP user roles and capabilites are written into the options database for each blog during blog creation in schema.php. You can see there how caps and roles are added.
Then, you'll need to run some kind of option update to hit the blogs that already exist to update their $wp_roles.
WPMU Power Tools is a nice plugin to run snips of code to update options on multiple blogs at a time. I've used it to do someting like what you describe and it works easy-peezy.
Print something like the following $wp_user_roles in a blog template index to see what the roles caps are saved in an existing blog's user_roles option.
global $wpdb, $blog_id;
$wp_user_roles = get_blog_option( $blog_id, "{$wpdb->base_prefix}{$blog_id}_user_roles" );
echo '<pre>';
print_r($wp_user_roles);
echo '</pre>';
By the way, keep WPMU up to date and run the Upgrade button under SiteAdmin to be certain roles for 2.8 are up to date.
I would use WPMU Power Tools. /wp-admin/includes/schema.php has many examples of how to add_cap and to remove_cap run something like this:
$wp_roles->remove_cap('rolename', 'capname');
$wp_roles->add_cap('rolename', 'capname');
The wp-includes/capabilities.php has the add_cap, add_role, remove_cap, remove_role functions and examples for snippets easily built to use with Power Tools.
Have a db backup handy when using PowerTools, it is not to be trifled with. Practice code snips on a "sandbox" install of WPMU. Do not experiment with a live site till you know a snip of code works and you know what you are doing. PowerTools: with great power comes great responsibility.