Security Vulnerability in Microsoft .NET Passport

Stuart Moore writes "A vulnerability was reported in Microsoft .NET Passport, also affecting Hotmail user accounts. The simple flaw allows an attacker to change any person's password to an arbitrary value. The attacker can then gain access to the victim's accounts, as well as to the victim's personal information (if any is stored w/ Passport). Muhammad Faisal Rauf Danka posted a note to the Full-Disclosure security e-mail list after multiple unsuccessful attempts to contact Microsoft." There's a news report as well.

Comments

Re:thoughts

[binarytoaster]

Wala, you now have rights to that hotmail account
w00p! w00p! Stupid person alert!

I feel the need to inform you that the correct spelling of that word is voila. Look it up sometime. Bleh.