PakCERT has discovered two serious vulnerabilities in Microsoft .Net Passport Services, which if exploited, affects over 200 million users worldwide. Using these vulnerabilities and the single sign-in feature of Microsoft .Net Passport, an attacker can completely take control of a user?s account including Hotmail email account, personal information, credit card numbers, shopping lists etc and use it on any of the .Net Passport participating web sites.
Issue One: Bypass Security Questions
An attacker can bypass the security questions asked before resetting the password. When Microsoft Hotmail/.Net Passport users forget their passwords, they have to fill out a web form that requires their email address, state, zip code and country. After submitting the correct information users are prompted to answer the secret question they entered during their signup for the service.
As a result of this vulnerability, Microsoft Hotmail/.Net Passport users who rely on questions like ?What?s my name?? or ?What?s my favorite color?? could find themselves loosing their accounts.
Issue Two: Password Reset Vulnerability
An attacker can reset any Microsoft Hotmail/.Net Passport user account with no prior information like state, zip, country, answer to the secret question and the old password. Normally, a user has to answer the security questions and than answer the secret question if he wants to reset his password. By exploiting this vulnerability, an attacker can submit a specially crafted URL to get the password reset instructions and reset any user?s password.
TECHNICAL DETAILS
Due to the nature of this vulnerability and the fact that there is no fix available yet, no technical details are being made available with this advisory. Full technical details will be made available on our website once the vulnerability is fixed by Microsoft. Please note that we were forced to release this information public as these vulnerabilities are actively being exploited in the wild and are one of the most severe vulnerabilities ever found in Microsoft Hotmail/.Net Passport.
FOUND BY: Qazi Ahmed & Shoaib Rehman
Source:
http://www.pakcert.org/advisory/PC-080503.txt
An attacker can bypass the security questions asked before resetting the password. When Microsoft Hotmail/.Net Passport users forget their passwords, they have to fill out a web form that requires their email address, state, zip code and country. After submitting the correct information users are prompted to answer the secret question they entered during their signup for the service.
As a result of this vulnerability, Microsoft Hotmail/.Net Passport users who rely on questions like ?What?s my name?? or ?What?s my favorite color?? could find themselves loosing their accounts.
Issue Two: Password Reset Vulnerability
An attacker can reset any Microsoft Hotmail/.Net Passport user account with no prior information like state, zip, country, answer to the secret question and the old password. Normally, a user has to answer the security questions and than answer the secret question if he wants to reset his password. By exploiting this vulnerability, an attacker can submit a specially crafted URL to get the password reset instructions and reset any user?s password.
TECHNICAL DETAILS
Due to the nature of this vulnerability and the fact that there is no fix available yet, no technical details are being made available with this advisory. Full technical details will be made available on our website once the vulnerability is fixed by Microsoft. Please note that we were forced to release this information public as these vulnerabilities are actively being exploited in the wild and are one of the most severe vulnerabilities ever found in Microsoft Hotmail/.Net Passport.
FOUND BY: Qazi Ahmed & Shoaib Rehman
Source:
http://www.pakcert.org/advisory/PC-080503.txt
