An information disclosure vulnerability has been identified in Windows 2000 and Windows XP, which can be exploited by a malicious, local user to gain knowledge of sensitive information.

The vulnerability is caused by an access control error in the Windows API, which allows a program using the PostMessage function to send EM_SETPASSWORDCHAR messages to the message queue of dialog boxes owned by other processes. This can be exploited to disclose masked passwords by constructing a password revealing program.

This kind of programs have previously been known for other versions of Windows, but have not existed for Windows 2000/XP, since the SendMessage function exploited in these programs was secured in Windows 2000/XP.

Solution
Allow only trusted users access to computers and do not download and install programs from untrusted sources. Futhermore, do not rely on programs masking passwords.

Provided and/or discovered by
Palan

Deep Links
Links available to Secunia VIM customers