IBM OEM Microsoft Windows XP And Windows XP SP1 Default Administration Account Vulnerability

Bugtraq ID:	11199
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 15 2004 12:00AM
Updated:	Sep 15 2004 12:00AM
Credit:	Jason Lash from SECNAP Network Security disclosed this vulnerability.
Vulnerable:	IBM Microsoft Windows XP SP1 OEM Version IBM Microsoft Windows XP OEM Version
Not Vulnerable:

IBM OEM Microsoft Windows XP And Windows XP SP1 Default Administration Account Vulnerability

IBM OEM Microsoft Windows XP And Windows XP SP1 are both reported to contain a default passwordless administrative account.

Reportedly, during the installation process of IBMs OEM version of Windows XP and Windows XP SP1, the process automatically creates an administrator account and fails to set a password for it. The user is not made aware of the account during installation.

Users installing this version of Microsoft Windows may fail to properly secure this account, allowing for local attackers to gain administrative privileges. Network access to accounts without passwords is denied, so this is only a local vulnerability.

This vulnerability reportedly only affects IBMs OEM version of Microsoft Windows XP and Windows XP Service Pack 1.

IBM OEM Microsoft Windows XP And Windows XP SP1 Default Administration Account Vulnerability

An exploit is not required.

IBM OEM Microsoft Windows XP And Windows XP SP1 Default Administration Account Vulnerability

Solution:
IBM has stated that further releases of their OEM version of Microsoft Windows XP will contain a fix that will display a "Set an Administrator Password" screen during the installation process. These fixed releases are estimated to be available by the end of October, 2004.

IBM OEM Microsoft Windows XP And Windows XP SP1 Default Administration Account Vulnerability

References:

• Windows XP Homepage (Microsoft)
  
• Vulnerability in IBM Windows XP: default hidden Administrator account allows loc ("Michael Scheidell" )