RE: Hotmail & Passport (.NET Accounts) Vulnerability

[Marc Slemko <marcs () znep com>]

On Thu, 8 May 2003, Christopher F. Herot wrote:

> I just tried this.  It does indeed generate the "reset password" email
> and link, which is scary, but following the instructions does not really
> reset the password, at least not for the limited test I performed.

It definitely worked for me around 20:45 (-0700).

Microsoft may have gotten it disabled by now, they do generally have
a very quick reaction time to such trivial stupid massive gaping holes
once they actually get the message about them.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html