Bugtraq mailing list archives
Re: Insufficient Authentication vulnerability in Acer notebooks
From: dpo5003 () gmail com
Date: Tue, 12 May 2009 02:14:50 +0000
That is I standard issue with Windows XP. With any installation of it you have to boot in safe mode and manually set a password on the hidden admin account. -Dave Ortiz Sent from my Verizon Wireless BlackBerry -----Original Message----- From: David Sánchez Martín <dsanchez () e2000 es> Date: Mon, 11 May 2009 15:55:04 To: <bugtraq () securityfocus com> Subject: RE: Insufficient Authentication vulnerability in Acer notebooks hi folk, Is not that a simple design decission? (truly brain-dead, but a conscious decission).
-----Mensaje original----- De: MustLive [mailto:mustlive () websecurity com ua] Enviado el: domingo, 10 de mayo de 2009 15:23 Para: bugtraq () securityfocus com Asunto: Insufficient Authentication vulnerability in Acer notebooks Hello SecurityFocus! I want to warn you about vulnerability in Acer notebooks. It's Insufficient Authentication vulnerability. Which I found 28.04.2009 in two my notebooks. At these notebooks Windows XP Home Rus is using, in case of other OS the vulnerability can be also present. In Windows XP Home in default administrator's account “Administrator” there is empty password. And it does not set equal to password of first admin, when admin account is creating during first start of notebook (as it happens during installation of Windows XP). So with physical access to notebook, anybody can enter into the system with administrator's rights. Vulnerable models of notebooks: Acer TravelMate 2313LC, Acer TravelMate 2413LC and potentially other models. I mentioned about these vulnerability at my site (http://websecurity.com.ua/3127/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua
Current thread:
- Insufficient Authentication vulnerability in Acer notebooks MustLive (May 11)
- RE: Insufficient Authentication vulnerability in Acer notebooks David Sánchez Martín (May 11)
- Re: Insufficient Authentication vulnerability in Acer notebooks dpo5003 (May 12)
- Re: Insufficient Authentication vulnerability in Acer notebooks Garrett M. Groff (May 12)
- Re: Insufficient Authentication vulnerability in Acer notebooks Øystein Larsen (May 12)
- Re: Insufficient Authentication vulnerability in Acer notebooks dpo5003 (May 12)
- <Possible follow-ups>
- Re: Insufficient Authentication vulnerability in Acer notebooks MustLive (May 19)
- Re: Insufficient Authentication vulnerability in Acer notebooks Susan Bradley (May 20)
- Re: Insufficient Authentication vulnerability in Acer notebooks MustLive (May 28)
- Re: Insufficient Authentication vulnerability in Acer notebooks Susan Bradley (May 28)
- Re: Insufficient Authentication vulnerability in Acer notebooks Susan Bradley (May 20)
- RE: Insufficient Authentication vulnerability in Acer notebooks David Sánchez Martín (May 11)