Patch Available for "SQL Server 7.0 Service Pack Password"
Vulnerability
Originally posted: May 30, 2000
Updated: June 15, 2000
Summary
=======
On May 30, 2000, Microsoft released the original version of this
bulletin, to announce the availability of a patch that eliminates a
security vulnerability in Microsoft(r) SQL Server(r) 7.0 Service Packs
1 and 2 installation routine. When run on a machine that is configured
in a non-recommended mode, the routines record the administrator
password in a log file, where it could be read by any user who could
log onto the server at the keyboard.
On June 15, 2000, the bulletin was updated to note that, under the
same conditions as originally reported, the password also is recorded
in a second file. A new version of the patch is available that
prevents the password from being recorded in either file.
Frequently asked questions regarding this vulnerability and the
patch can be found at
http://www.microsoft.com/technet/security/bulletin/fq00-035.asp
Issue
=====
When SQL Server 7.0 Service Packs 1 or 2 are installed on a machine
that is configured to perform authentication using Mixed Mode, the
password for the SQL Server standard security System Administrator
(sa) account is recorded in plaintext in the files %TEMP%sqlsp.log
and %WINNT%setup.iss. The default permissions on the files would
allow any user to read them who could log onto the server
interactively.
The password is only recorded if Mixed Mode is used, and even then,
only if the adminstrator chose to use SQL Server Authentication when
installing the service pack. Microsoft has long recommended that SQL
servers be configured to use the more secure Windows NT Authentication
Mode, and customers who have followed this recommendation would not be
affected. Even on affected machines, the password could not be
compromised if, per normal security recommendations, normal users are
prevented from logging onto the machine interactively.
Download
Vulnerability
Originally posted: May 30, 2000
Updated: June 15, 2000
Summary
=======
On May 30, 2000, Microsoft released the original version of this
bulletin, to announce the availability of a patch that eliminates a
security vulnerability in Microsoft(r) SQL Server(r) 7.0 Service Packs
1 and 2 installation routine. When run on a machine that is configured
in a non-recommended mode, the routines record the administrator
password in a log file, where it could be read by any user who could
log onto the server at the keyboard.
On June 15, 2000, the bulletin was updated to note that, under the
same conditions as originally reported, the password also is recorded
in a second file. A new version of the patch is available that
prevents the password from being recorded in either file.
Frequently asked questions regarding this vulnerability and the
patch can be found at
http://www.microsoft.com/technet/security/bulletin/fq00-035.asp
Issue
=====
When SQL Server 7.0 Service Packs 1 or 2 are installed on a machine
that is configured to perform authentication using Mixed Mode, the
password for the SQL Server standard security System Administrator
(sa) account is recorded in plaintext in the files %TEMP%sqlsp.log
and %WINNT%setup.iss. The default permissions on the files would
allow any user to read them who could log onto the server
interactively.
The password is only recorded if Mixed Mode is used, and even then,
only if the adminstrator chose to use SQL Server Authentication when
installing the service pack. Microsoft has long recommended that SQL
servers be configured to use the more secure Windows NT Authentication
Mode, and customers who have followed this recommendation would not be
affected. Even on affected machines, the password could not be
compromised if, per normal security recommendations, normal users are
prevented from logging onto the machine interactively.
Download
