bugtraq - Re: Insufficient Authentication vulnerability in Acer notebooks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <352398549-1242094456-cardhu_decombobulator_blackberry.rim.net-153322763-@bxe1021.bisx.prod.on.blackberry>
Date: Tue, 12 May 2009 02:14:50 +0000
From: dpo5003@...il.com
To: bugtraq@...urityfocus.com
Subject: Re: Insufficient Authentication vulnerability in Acer notebooks

That is I standard issue with Windows XP.  With any installation of it you have to boot in safe mode and manually set a password on the hidden admin account.

-Dave Ortiz 

Sent from my Verizon Wireless BlackBerry

-----Original Message-----
From: David Sánchez Martín <dsanchez@...00.es>

Date: Mon, 11 May 2009 15:55:04 
To: <bugtraq@...urityfocus.com>
Subject: RE: Insufficient Authentication vulnerability in Acer notebooks


hi folk,

    Is not that a simple design decission? (truly brain-dead, but a
conscious decission).




> -----Mensaje original-----
> De: MustLive [mailto:mustlive@...security.com.ua] 
> Enviado el: domingo, 10 de mayo de 2009 15:23
> Para: bugtraq@...urityfocus.com
> Asunto: Insufficient Authentication vulnerability in Acer notebooks
> 
> Hello SecurityFocus!
> 
> I want to warn you about vulnerability in Acer notebooks.
> 
> It's Insufficient Authentication vulnerability. Which I found 
> 28.04.2009 in
> two my notebooks. At these notebooks Windows XP Home Rus is 
> using, in case
> of other OS the vulnerability can be also present.
> 
> In Windows XP Home in default administrator's account 
> “Administrator” there
> is empty password. And it does not set equal to password of 
> first admin,
> when admin account is creating during first start of notebook 
> (as it happens
> during installation of Windows XP). So with physical access 
> to notebook,
> anybody can enter into the system with administrator's rights.
> 
> Vulnerable models of notebooks: Acer TravelMate 2313LC, Acer 
> TravelMate
> 2413LC and potentially other models.
> 
> I mentioned about these vulnerability at my site 
> (http://websecurity.com.ua/3127/).
> 
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> http://websecurity.com.ua 
> 
>