Bardon Data Systems WinU Backdoor Password Vulnerability

Bugtraq ID:	1801
Class:	Design Error
CVE:	CVE-2000-0988
Remote:	No
Local:	Yes
Published:	Oct 13 2000 12:00AM
Updated:	Jul 11 2009 03:56AM
Credit:	Posted to Bugtraq on October 13, 2000 by Nu Omega Tau <[email protected]>.
Vulnerable:	Bardon Data Systems WinU 5.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

Bardon Data Systems WinU Backdoor Password Vulnerability

Bardon Data Systems WinU is a full Windows 95/98/NT user interface replacement with added security capabilities.

The feature 'emergency password' allows the administrator to gain full access to all configuration settings of the WinU interface. A number of valid passwords are publicly available which can be used by a malicious user who does not possess administrative privileges. The user could gain full administrative control over the WinU application through the user of these passwords.

Bardon Data Systems WinU Backdoor Password Vulnerability

The password for each version is as follows:

WinU 1.0-2.02:
KX98592V63 BARRY SMILER

WinU 3.2a:
LRTV5 BARRY SMILER

WinU 4.1-4.3:
R2NAX14 BARRY SMILER

WinU 5.1:
1FPW804 BARRY SMILER

Passwords applicable for multiple versions:
barry smiler wrote this
gorilla obstacle ransom
pound negotiate family
green temple peppercorn
pensive resident jitterbug
cashier castle backfire
agency selective trooper
sweetheart quill logical
intensive grand poker
piano turnpike verify

Bardon Data Systems WinU Backdoor Password Vulnerability


Bardon Data Systems WinU 5.1

• Bardon Data Systems WinU 5.2
  Fill out the required information and download the free upgrade.
  http://www.bardon.com/winudl.htm

Bardon Data Systems WinU Backdoor Password Vulnerability

References:

• WinU Product Homepage (Bardon Data Systems)