Date: Tue, 23 Mar 1999 15:20:55 -0500
From: Brett Robins <brett@BALISOFT.COM>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: Time/Date bug in Windows' OSes
Although not a security bug, this certainly is a potentially large
bug in my eyes. You can accidentally change the systems date/time by using
the calendar function from the systray or Control Panel. This bug can be
successfully reproduced on all MS OS platforms.This includes win95,win98, NT
4.0 SP3, and SP4 (both workstation and server).
I reproduced the error by opening a DOS box, typing Date (to confirm the
days date). Then opened the Date/Time Properties Dialog Applet. Pull down
the Month drop down window. Select the next month, (in this case april). DO
NOT hit apply. Go back to the DOS box and type date.....hmmm, skipped ahead
a month!@#$ Hitting Cancel on the Date/Time Properties Dialog Applet will
restore your machines date back to the original.
How did I find out such a dumb ass bug that has been around for 5
years? I needed to find out what day of the week 3 months from a date was. I
happened to be in our server room that does not include a calendar, but
happened to be logged into our corporate PDC. Well the shit hit the fan.
Since i advanced the date 3 months, (then hit cancel), it expired every user
account that logged in during this time of advancing the date and hitting
cancel.This included anyone that accessed a network resource that required a
login, (ie printing). That wiped out about half of our users. Then as well
we renew our Shiva firewall certs every 3 months. That blew away a few more
users. Everything was upside down here for a while. Good old M$ couldnt even
help me; they wanted me to replace the Motherboard--lazy asses. As it turned
out, i had to invesigate and discover a bug that has been around for years
on my own. Now i could not find a damn thing about it; my apologies it has
already been discovered
Regards,
Brett Robins
Brett Robins
MIS Network Engineer
Servicesoft Technologies Inc.
970 Lawrence Ave. W. Suite 505
Toronto, Ontario, Canada.
M6A 3B6
--------------------------------------------------------------------------------
Date: Tue, 23 Mar 1999 13:46:07 -0800
From: Paul Donnelly <pauldon@MICROSOFT.COM>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: Re: Time/Date bug in Windows' OSes
Brett, if it's any consolation at all this behavior has changed for Windows
2000. You will have to hit OK or Apply until the change takes effect.
Paul
-----Original Message-----
>From: Brett Robins [mailto:brett@BALISOFT.COM]
Sent: Tuesday, March 23, 1999 12:21 PM
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: Time/Date bug in Windows' OSes
<snip>
I reproduced the error by opening a DOS box, typing Date (to confirm the
days date). Then opened the Date/Time Properties Dialog Applet. Pull down
the Month drop down window. Select the next month, (in this case april). DO
NOT hit apply. Go back to the DOS box and type date.....hmmm, skipped ahead
a month!@#$ Hitting Cancel on the Date/Time Properties Dialog Applet will
restore your machines date back to the original.
<snip>