[il-talk] Critical security flaw in JAWS

[Sam Joehl]

By Tyler Spivey

I have found a critical security flaw in the JAWS Screen reader that
allows an attacker to gain full system-level access to

the machine. I have tested this on 32-bit Windows Vista
with JAWS 10.0.1154 and 32-bit Windows 7 with JAWS 11.0.611 Beta.

Instructions:

1. From the Windows logon screen with JAWS running, press insert+f2. Run
JAWS Manager will appear.
2. Select Settings Packager, and press ok. Settings Packager will open.
3. From Settings Packager, go to File menu > Open, or press ctrl+o.
4. In the open dialog, type “%windir%\system32\*.exe” into the file name
field (without the quotes) and press enter.
5. In the list of files, find cmd. Right click on it, or press the
applications key and select Run as Administrator.
A system-level command prompt should open. To get out of it, type exit and
press enter, then close the Settings Packager.



Update 2009-10-17: updated contact info with secondary email address.
Please send any mail there until this note is removed.



Contact information:
tyler Spivey
Email:  <mailto:tspivey at pcdesk.net> tspivey8 at gmail.com, PGP key:
0×048C58A4
Twitter: tspivey