Bugtraq mailing list archives
Microsoft Security Bulletin (MS00-041)
From: secnotif () MICROSOFT COM (Microsoft Product Security)
Date: Wed, 14 Jun 2000 14:37:28 -0700
The following is a Security Bulletin from the Microsoft Product Security Notification Service. Please do not reply to this message, as it was sent from an unattended mailbox. ******************************** -----BEGIN PGP SIGNED MESSAGE----- Microsoft Security Bulletin (MS00-041) - -------------------------------------- Patch Available for "DTS Password" Vulnerability Originally posted: June 13, 2000 Summary ======== Microsoft has released a patch that eliminates a security vulnerability in a component that ships with Microsoft(r) SQL Server 7.0. If the component is configured improperly, the vulnerability could allow passwords to be compromised. Frequently asked questions regarding this vulnerability and the patch can be found at http://www.microsoft.com/technet/security/bulletin/fq00-041.asp Issue ====== Data Transformation Service (DTS) packages in SQL Server 7.0 allow database administrators to create a package that will perform a particular database action at regular intervals. As part of the creation of a DTS package, the administrator provides the account name and password under which the action should be taken. However, the password can be retrieved by programmatically interrogating the package's Properties dialogue. The vulnerability could only occur if several best practices have not been followed: - The creator of the DTS package chose to supply a username and password instead of using Windows Authentication. - The DTS package was created without restricting who can edit it. - The SQL Server administrator allowed Guest access to the SQL Server MSDB database. Affected Software Versions ========================== - Microsoft SQL Server 7.0 Patch Availability ================== - Intel: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=21905 - Alpha: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=21906 NOTE: Additional security patches are available at the Microsoft Download Center More Information ================= Please see the following references for more information related to this issue. - Frequently Asked Questions: Microsoft Security Bulletin MS00-041, http://www.microsoft.com/technet/security/bulletin/fq00-041.asp - Microsoft Knowledge Base article Q264880 discusses this issue and will be available soon. - Microsoft TechNet Security web site, http://www.microsoft.com/technet/security/default.asp Obtaining Support on this Issue =============================== This is a fully supported patch. Information on contacting Microsoft Technical Support is available at http://support.microsoft.com/support/contact/default.asp. Revisions ========= June 13, 2000: Bulletin Created. - --------------------------------------------------------- THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. (c) 2000 Microsoft Corporation. All rights reserved. Terms of use. -----BEGIN PGP SIGNATURE----- Version: PGP Personal Privacy 6.5.3 iQEVAwUBOUf7F40ZSRQxA/UrAQFKAAf9EAS3hTkWlr/MgoSn0lZ4NvuUvX2+3pJm PnG0LLSmzK4nr+Kc2Seb2M2GNm7kaO9Ov6W8lp7u6NDSOqjnNqsZgHaZ0bW8Dxv6 uuwv/6Oumhamc99gQKGhV2ozKCqeR4Xr6mFkcwEAuSY9s8oXramDtPDdramVAPMY uj9K3/uuriyEworV6N3ReiTdf+IVwdUnZwvIws5MPDqfHhOHZc9SSbgeA57WiNXv SkBILt9GK4dwciB6ETVIkoV+ZtnJObG6rM1vJa8pc7m1T6+H69tWKLZp/iOmUywQ xBGHBxrihOPVGEtrCDWBSvvwuFhs4xB9TpeXuMQwDT2q4dBoNTmv/A== =2nX9 -----END PGP SIGNATURE----- ******************************************************************* You have received this e-mail bulletin as a result of your registration to the Microsoft Product Security Notification Service. You may unsubscribe from this e-mail notification service at any time by sending an e-mail to MICROSOFT_SECURITY-SIGNOFF-REQUEST () ANNOUNCE MICROSOFT COM The subject line and message body are not used in processing the request, and can be anything you like. To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp. For more information on the Microsoft Security Notification Service please visit http://www.microsoft.com/technet/security/notify.asp. For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.
Current thread:
- Re: Sendmail local root exploit on linux 2.2.x, (continued)
- Re: Sendmail local root exploit on linux 2.2.x Alan Iwi (Jun 12)
- Splitvt exploit syzop (Jun 14)
- Re: Splitvt exploit Joey Hess (Jun 14)
- Re: Splitvt exploit Andrey Savochkin (Jun 16)
- Re: Splitvt exploit Joey Hess (Jun 16)
- NAI WebShield SMTP does not scan base64 encoding chris.paget () ANALYSYS COM (Jun 20)
- Re: Splitvt exploit Joey Hess (Jun 14)
- Re: Splitvt exploit Kris Kennaway (Jun 15)
- Re-release of IIS 5.0 Patch for MS00-031 Microsoft Product Security (Jun 16)
- Infosec.20000617.panda.a Ian Vitek (Jun 17)
- Reliable Software Technologies releases new e-mail virus protection software Tim Hollebeek (Jun 14)
- Microsoft Security Bulletin (MS00-041) Microsoft Product Security (Jun 14)