(I) UPDATE - PFCUser Account, Compaq Management Agents for server s for Microsoft windows NT

Boren, Rich (Rich.BorenCOMPAQ.COM)
Wed, 15 Sep 1999 07:41:20 -0500

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
• Next message: Todd Sabin: "Re: Alert: Exploit of RASMAN service key escalates privileges"
• Previous message: Quimeras: "RV: Windows NT Remote Exploit"

> Update: CASE ID SSRT0620 15 SEP 1999
> Orig. Post 04 SEP 1999
>
        RE: Potential Security Vulnerability with PFCUser Account
> in Compaq Management Agents for Servers for Microsoft Windows NT.
>
> Source: Compaq Computer Corporation
> Software Security Response Team
>
> Compaq continues to take a serious approach to quality and security
> in all of its software products, and strives to address issues, provide
> solutions and communicate them in a timely and responsible manner.
> This communication is to respond to some concerns that have been
> raised recently with the creation of the PFCUser account during an
> install of the Compaq Management Agents for Windows NT.
>
> Issues
>
> 1. Vulnerability of the PFCUser account due to automatic creation of
> password
> 2. The user is not notified that the PFCUser account is being created
> 3. The level of rights assigned to the account
> 4. The uncertainty of uninstall removing the user account
>
> Recommended action
>
> To promptly alleviate concerns regarding the vulnerability of the account,
>
> Compaq recommended to customers to change the password.
> Instructions on how to do this are provided in the bulletin titled
> 'PFCUser account Vulnerability in the Compaq Management
> Agents for Servers for Windows NT'.
> (available at ) http://www.compaq.com/sysmanage
>
> Changes being implemented in v4.40B
>
> Like many other Windows NT applications, the Windows NT
> Management component of the Compaq Management Agents
> also requires a user account to interact with the operating system
> to gather detailed OS level information.
> A summary of the changes in the updated release is as follows
>
> 1. The automatic creation of the user account and automatic
> generation of the password will be discontinued
>
> 2. A dialog box will notify the user that an account is required
> for the Windows NT Management component, and prompt the
> user to create an account and password.
>
> 3. The privileges associated with the user account have been
> changed, and the only user right retained is to allow the account
> to logon locally.
>
> 4. There were some issues with removal of the PFCUser account
> during uninstall of versions 4.20D and 4.22 of the Compaq Management
> Agents. The issues were fixed in version 4.23.
>
> The Compaq Foundation Agents v4.40B will be available as
> a SoftPAQ (SP 10629) at http://www.compaq.com/sysmanage by the
> last week of September. Further details of changes being made in this
> release are available at this site.
>
> _____________________________________________________
> (c) Copyright 1999 Compaq Computer Corporation.
> All Rights Reserved. Unpublished Rights
> Reserved Under The Copyright Laws Of The United States.
> _____________________________________________________
>
>

• Next message: Todd Sabin: "Re: Alert: Exploit of RASMAN service key escalates privileges"
• Previous message: Quimeras: "RV: Windows NT Remote Exploit"

This archive was generated by hypermail 2.0b3 on Fri Sep 17 1999 - 14:57:08 CDT