Millions of .Net Passport Accounts Put at Risk

Millions of .Net Passport accounts were threatened by a flaw in the log-in service's coding that allowed attackers to reset the password to any account, and thereby access users' personal information.

The problem enabled an attacker to change the password on any account for which he knew the user name, simply by entering a URL into a browser. News of the flaw was published on the Full Disclosure security mailing list late Wednesday night. Microsoft Corp., which owns the Passport service, quickly disabled the mechanism that allowed the unauthorized password changes.

More at eWeek