Microsoft Xbox Live Password Recovery Space as Password 弱身份验证

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
8.8	$0-$5k	0.00

摘要信息

检测到一个被分类为棘手的安全漏洞，影响Microsoft Xbox Live。此漏洞会影响未知代码的组件Password Recovery。由于属于Space as Password的一部分被操作，进而引发弱身份验证。另外，有可用的漏洞利用。

检测到一个被分类为棘手的安全漏洞，影响Microsoft Xbox Live。此漏洞会影响未知代码的组件Password Recovery。由于属于Space as Password的一部分被操作，进而引发弱身份验证。使用CWE来声明会导致 CWE-287 的问题。此安全漏洞在 2014-04-03 由Kristoffer Von Hassel 以5-year-old Ocean Beach boy exposes Microsoft Xbox vulnerability编号以影片（ABC 10 News）公开发布。索取公告的网址是10news.com。

暂无技术细节。此漏洞的受欢迎程度低于平均值。另外，有可用的漏洞利用。目前漏洞的结构决定了可能的价格范围为美元价USD $0-$5k。通告提到：

When 5-year-old Kristoffer Von Hassel is playing his Xbox, his feet don't touch the ground. But something he did has made the smartest guys at Microsoft pay attention. (...) A suddenly excited Kristoffer showed Dad that when he typed in a wrong password for his father’s account, it clicked to a password verification screen. By typing in space keys, then hitting enter, Kristoffer was able to get in through a back door.

如果有长度，则声明为概念验证。作为零日漏洞，其地下市场的估计价格约为$5k-$25k。

该公告包含如下评论：

In a statement, Microsoft said, "We're always listening to our customers and thank them for bringing issues to our attention. We take security seriously at Xbox and fixed the issue as soon as we learned about it." Kristoffer will receive four games, $50 and a year-long subscription to Xbox Live from Microsoft. He also knows what he now wants to be when he grows up: a gamer. His dad is leaning toward something in computer security.