bugtraq - Insufficient Authentication vulnerability in Asus notebook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 14 May 2009 16:23:53 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <bugtraq@...urityfocus.com>
Subject: Insufficient Authentication vulnerability in Asus notebook

Hello SecurityFocus!

I want to warn you about Insufficient Authentication vulnerability in Asus 
notebook.

After publication of information about Insufficient Authentication 
vulnerability in Acer notebooks 
(http://www.securityfocus.com/archive/1/503398/30/0/), I decided to 
investigate all notebooks of my friends. Particularly I checked two Asus 
notebooks: at one with Windows XP Professional there is no such 
vulnerability, at another with Windows XP Home Edition there is such 
vulnerability.

In Windows XP Home in default administrator's account “Administrator” there
is empty password. And it does not set equal to password of first admin,
when admin account is creating during first start of notebook (as it happens
during installation of Windows XP). So with physical access to notebook,
anybody can enter into the system with administrator's rights.

Vulnerable models of notebooks: Asus А6500R and potentially other models.

I mentioned about these vulnerability at my site 
(http://websecurity.com.ua/3139/).

Now I'm continue to investigate this situation. If you'll find such case in 
your notebook or in desktop PC, then inform me on email.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua