bugtraq - Insufficient Authentication vulnerability in Acer notebooks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 10 May 2009 16:22:32 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <bugtraq@...urityfocus.com>
Subject: Insufficient Authentication vulnerability in Acer notebooks

Hello SecurityFocus!

I want to warn you about vulnerability in Acer notebooks.

It's Insufficient Authentication vulnerability. Which I found 28.04.2009 in
two my notebooks. At these notebooks Windows XP Home Rus is using, in case
of other OS the vulnerability can be also present.

In Windows XP Home in default administrator's account “Administrator” there
is empty password. And it does not set equal to password of first admin,
when admin account is creating during first start of notebook (as it happens
during installation of Windows XP). So with physical access to notebook,
anybody can enter into the system with administrator's rights.

Vulnerable models of notebooks: Acer TravelMate 2313LC, Acer TravelMate
2413LC and potentially other models.

I mentioned about these vulnerability at my site 
(http://websecurity.com.ua/3127/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua