Critical security flaw in JAWS

I have found a critical security flaw in the JAWS Screen reader that allows an attacker to gain full system-level access to

the machine. I have tested this on 32-bit Windows Vista
with JAWS 10.0.1154 and 32-bit Windows 7 with JAWS 11.0.611 Beta.

Instructions:

1. From the Windows logon screen with JAWS running, press insert+f2. Run JAWS Manager will appear.
2. Select Settings Packager, and press ok. Settings Packager will open.
3. From Settings Packager, go to File menu > Open, or press ctrl+o.
4. In the open dialog, type “%windir%\system32\*.exe” into the file name field (without the quotes) and press enter.
5. In the list of files, find cmd. Right click on it, or press the applications key and select Run as Administrator.
A system-level command prompt should open. To get out of it, type exit and press enter, then close the Settings Packager.

Update: audio demonstration available here.
 

Contact information:
tyler Spivey
Email: tspivey@pcdesk.net, PGP key: 0x048C58A4
Twitter: tspivey

About these ads

Tags: ,

6 Responses to “Critical security flaw in JAWS”

  1. Pranav Lal Says:

    A more responsible way to report such a flaw is to contact the manufacturor. All the same, many thanks for the notification. Does this also apply if the user is running jaws in an account without administrator privilages?

  2. Tyler Spivey Says:

    @Pranav Lal
    yes. It gives system-level access, which is higher than administrator; since the secure desktops and windows logon screens are running as system. From there, you can use net localgroup to add yourregular user account to the administrators group or do whatever you want.

  3. Travis Says:

    Since this is using the Windows standard open dialog (common dialog/control) this could easily be as much a Microsoft problem as a JAWS problem. The “Run as Administrator” should be asking for an admin password at all times in my opinion. Especially if the user isn’t logged in.

  4. Ricky Goines Says:

    I believe Microsoft should be the company to address this problem. Think I’ll get a Mac. Lol!

  5. serrebi Says:

    I’m glad you did the right thing and posted this for all to see.

  6. JAWS security flaw, round 2 « Tyler Spivey’s blog Says:

    [...] Tyler Spivey’s blog Tyler Spivey’s Accessible Unix blog « Critical security flaw in JAWS [...]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


Follow

Get every new post delivered to your Inbox.

Join 289 other followers

%d bloggers like this: