[VulnDiscuss] Hotmail (Accounts) Vulnerability

Hotmail (Accounts) Vulnerability

I've tried to contact Microsoft support for Hotmail and Passport via
e-mail several times, but haven't received a response from them. 

First before you can get access to the Secret Question page, you must
choose a Country match for the account, that's not the hard part. Isn't
it?
   
Well, this problem appears to be due to an error in code used to handle
new accounts and only affects accounts for which the "Secret Question" for
password recovery has not been set. 
   
An account for which no secret password exists can be modified by other
users by entering a new password.  It's easily identifiable because the
Secret Question field will be titled like "notset" let the Secret Answer
in blank and then set a new password for the account, effectively giving
you control of the account.

Hotmail has a couple of years with this Secret Question validation (before
this validation was not obligatory),  kind of old and
a lot accounts exists with this flaw.

Best Regards

Victor Manuel Alvarez Castro (Birttok) [[email protected]] 
Security Consultant 

Greets to [RaFa] from Scientech de Venezuela
Also  www.cpiu.us for their great noble support

PD. (if somebody needs an example please send me an email)

 <<...OLE_Obj...>>