bugtraq - ZH2003-5SA (security advisory): Windows beta webserver for pocket pc: full remote access.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20030802211949.5926.qmail@www.securityfocus.com>
Date: 2 Aug 2003 21:19:49 -0000
From: G00db0y <G00db0y@...e-h.org>
To: bugtraq@...urityfocus.com
Subject: ZH2003-5SA (security advisory): Windows beta webserver for pocket
    pc: full remote access.

ZH2003-5SA (security advisory): Windows beta webserver for pocket pc: full 
remote access.

Published: 03/08/2003

Released: 03/08/2003

Name: Windows beta webserver for pocket pc: full remote access

Issue: Remote attackers have full access to pocket pc. 

Author: G00db0y & SyS64738

Contact us: G00db0y@...e-h.org & admin@...e-h.org

Vendor: www.microsoft.com

Description

***********

Zone-h Security Team has discovered a security flaw in 
Windows beta webserver for pocket pc. 

Details

*******
As announced by SyS64378 at his Defcon speech.

The default installation of windows beta webserver allows an attacker to
gain full remote access without authentication simply logging to 
http://attacked_host/admin

The vendor has been notified and confirmed the vulnerability.
The product has been taken away from Microsoft website and will soon be 
replaced with a patched version.

Suggestions:

************

Disinstall it from your pocket pc.

G00db0y - SyS64738 www.zone-h.org admins

Original advisory here: http://www.zone-h.org/en/advisories/read/id=2808/