Microsoft Windows XP Safe Mode Policy Bypass Weakness

Bugtraq ID:	7046
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Mar 07 2003 12:00AM
Updated:	Mar 07 2003 12:00AM
Credit:	Discovery of this issue is credited to "Eitan Caspi" <[email protected]>.
Vulnerable:	Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Home SP1 Microsoft Windows XP Home
Not Vulnerable:

Microsoft Windows XP Safe Mode Policy Bypass Weakness

Microsoft Windows XP could allow an unprivileged user to log into the system when it is started in Safe Mode. Microsoft states that only members of the Administrators group should be able to log onto the system in Safe Mode.

Note that this weakness is only present when the Windows XP "Welcome Screen" is enabled. This can only be enabled on stand alone systems or systems that are part of a workgroup, not members of a domain.

Microsoft Windows XP Safe Mode Policy Bypass Weakness

There is no exploit code required.

Microsoft Windows XP Safe Mode Policy Bypass Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Windows XP Safe Mode Policy Bypass Weakness

References:

• Microsoft Knowledge Base Article - 292742 (Microsoft)