Vulnerability Note VU#338195

Overview

Microsoft SQL server versions 7.0 and 2000, as well as MSDE 1.0, may leave installation and log files on the server after the installation process is complete. These files may contain senstitive information such as passwords [used during the install]. Users with authenticated access to the server may be able to view this information and gain elevated privileges.

Description

Microsoft SQL server versions 7.0 and 2000, as well as MSDE 1.0, may leave installation and log files on the server that contain passwords, after the installation process is complete. Users that can authenticate to the server, or read files stored locally on the server may be able to view this information and gain elevated privileges. Note that while Microsoft SQL server versions 7.0 with SP 4 installed, and 2000 with SP 1 and 2 installed, encrypt the passwords prior to storing them in the temporary files, Microsoft's security bulletin (MS02-035) states that the encryption used is "fairly weak" and could be subject to "password cracking attacks."

Impact

Local authenticated users of the server may be able to view sensitive information such as passwords and gain elevated privileges.

Solution

Use the "KillPwd" utility provided in Microsoft's security bulletin MS02-035 and apply the relevent patches.

Delete the installation log files and the "setup.iss" file after installation.

Systems Affected (Learn More)

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Affected	-	26 Jul 2002

If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group	Score	Vector
Base	N/A	N/A
Temporal	N/A	N/A
Environmental	N/A	N/A

References

• http://www.microsoft.com/technet/security/bulletin/MS02-035.asp
• http://www.microsoft.com/technet/security/bulletin/MS00-035.asp
• http://msdn.microsoft.com/library/default.asp?URL=/library/techart/acaccessprojects.htm
• http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnmsde/html/msdeforvs.asp
• http://www.appsecinc.com/resources/alerts/mssql/02-0009.html
• http://www.securityfocus.com/bid/5203

Credit

This vulnerability was reported to Microsoft by Cesar Cerrudo.

This document was written by Jason A Rafail.

Other Information

• CVE IDs: CAN-2002-0643
• Date Public: 10 Jul 2002
• Date First Published: 26 Jul 2002
• Date Last Updated: 31 Jul 2002
• Severity Metric: 6.30
• Document Revision: 14