If you explore further research, you will find that this is not a bug, this is well known, and its not particular to Asus. 2009/5/14 MustLive <mustlive@xxxxxxxxxxxxxxxxxx>: > Hello SecurityFocus! > > I want to warn you about Insufficient Authentication vulnerability in Asus > notebook. > > After publication of information about Insufficient Authentication > vulnerability in Acer notebooks > (http://www.securityfocus.com/archive/1/503398/30/0/), I decided to > investigate all notebooks of my friends. Particularly I checked two Asus > notebooks: at one with Windows XP Professional there is no such > vulnerability, at another with Windows XP Home Edition there is such > vulnerability. > > In Windows XP Home in default administrator's account "Administrator" there > is empty password. And it does not set equal to password of first admin, > when admin account is creating during first start of notebook (as it happens > during installation of Windows XP). So with physical access to notebook, > anybody can enter into the system with administrator's rights. > > Vulnerable models of notebooks: Asus А6500R and potentially other models. > > I mentioned about these vulnerability at my site > (http://websecurity.com.ua/3139/). > > Now I'm continue to investigate this situation. If you'll find such case in > your notebook or in desktop PC, then inform me on email. > > Best wishes & regards, > MustLive > Administrator of Websecurity web site > http://websecurity.com.ua >
