From spencer@unb.ca Mon Aug 26 23:31:56 1996 Received: from unb.ca (hermes.csd.unb.ca [131.202.3.20]) by suburbia.net (8.7.4/Proff-950810) with ESMTP id XAA09056 for ; Mon, 26 Aug 1996 23:31:19 +1000 Received: (from cythera.unb.ca [131.202.3.18]) by unb.ca (8.7.5/960430-08:40) id KAA23981; Mon, 26 Aug 1996 10:31:00 -0300 (ADT) Received: (from cythera.unb.ca [131.202.3.18]) by cythera.unb.ca (8.7.5/8.7.1) with SMTP id KAA11699; Mon, 26 Aug 1996 10:31:00 -0300 (ADT) Date: Mon, 26 Aug 1996 10:30:59 -0300 (ADT) From: "Dwight E. Spencer" To: SekrtyXprt@aol.com cc: best-of-security@suburbia.net Subject: Re: BoS: Gaping Security Hole In-Reply-To: <960825000843_393312675@emout07.mail.aol.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII On Sun, 25 Aug 1996 SekrtyXprt@aol.com wrote: > Exploit: > 1. Press and hold the control-alt-delete keys and then release. [ here, i'm assuming this person is saying the "Task List" pops up. ] > 2. Drag the mouse over to the name of the screen saver and click ONCE. > 3. Click on the "End Task" button. (Or you can simple use Alt-E, again, > press and hold "Alt" and "E" and then release.) Various "patches" have been applied to systems in my office that use the Windows95 screen saver, and I tried this exploit on 2 of them. As soon as any one of these keys is hit, the "enter password" prompt comes up, and even repeated hits on c-a-d do not bring up the task list, or reboot the computer. The patches I have applied to our systems include: Install Service Pack 1 krnlupd mspwlupd2 oleupd I'm not sure if one of these updates fixes this "bug" or not, or perhaps it is in earlier releases of Windows95. Of these systems, one is an upgrade version, the other the OEM release. My laptop at home, I don't believe has these updates on it, and I'll try it there to see if this problem exists. If it does, I'll post and say so. dwight s. ----------------------------------------------------------------------- Dwight E. Spencer Canada's Community Access Network eMail: spencer@unb.ca, Server Administrator UNB, Fredericton, NB, Canada Phone: +1 506 447 3153 Url: http://cspace.unb.ca/~spencer/