Microsoft Windows XP Fast User Switching Account Lockout Vulnerability
BID:3717
Info
Microsoft Windows XP Fast User Switching Account Lockout Vulnerability
| Bugtraq ID: | 3717 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 19 2001 12:00AM |
| Updated: | Dec 19 2001 12:00AM |
| Credit: | Posted to NTBugTraq mailing list by Tomasz Polus <[email protected]> |
| Vulnerable: |
Microsoft Windows XP Professional Microsoft Windows XP Home |
| Not Vulnerable: | |
Discussion
Microsoft Windows XP Fast User Switching Account Lockout Vulnerability
Microsoft Windows XP offers a fast user switching feature that lets users quickly change accounts without logging off and logging on again. This service, in conjuction with the account lockout feature, can be used to lock all unprivileged users out of their accounts, without knowledge of other user account names. On machines with fast user switching and an account lockout threshold set (for invalid login attempts) a single user can use the fast switching feature to cycle to the same user account (i.e., fast switch to self) multiple times, resulting in a lockout of all users other than administrator.
Microsoft Windows XP offers a fast user switching feature that lets users quickly change accounts without logging off and logging on again. This service, in conjuction with the account lockout feature, can be used to lock all unprivileged users out of their accounts, without knowledge of other user account names. On machines with fast user switching and an account lockout threshold set (for invalid login attempts) a single user can use the fast switching feature to cycle to the same user account (i.e., fast switch to self) multiple times, resulting in a lockout of all users other than administrator.
Exploit / POC
Microsoft Windows XP Fast User Switching Account Lockout Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Microsoft Windows XP Fast User Switching Account Lockout Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Microsoft Windows XP Fast User Switching Account Lockout Vulnerability
References:
References:
- Windows XP security concerns (Tomasz Polus