Microsoft SQL Server DTS Password Disclosure Vulnerability

Bugtraq ID:	1292
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	May 30 2000 12:00AM
Updated:	May 30 2000 12:00AM
Credit:	Posted to Bugtraq by Justin Gunther <[email protected]> on May 26, 2000.
Vulnerable:	Microsoft SQL Server 7.0 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft SQL Server 6.5
Not Vulnerable:

Microsoft SQL Server DTS Password Disclosure Vulnerability

It is possible for a user to reveal the database passwords of other users by viewing the properties of DTS packages they have created.

In the properties of a connection object within the data transformation services, a dialog box will appear which displays the username and asterisks in the password field. Although it is obfuscated, the password is present. Various utilities exist to retrieve the password from the field.

Microsoft SQL Server DTS Password Disclosure Vulnerability

See Discussion.

Microsoft SQL Server DTS Password Disclosure Vulnerability


Microsoft SQL Server 7.0

• Microsoft DTSUIa
  Alpha
  http://download.microsoft.com/download/sql70/DTSPWFix/7.0/ALPHA/EN-US/ DTSUIa.exe


• Microsoft DTSUIi
  Intel
  http://download.microsoft.com/download/sql70/DTSPWFix/7.0/WIN98/EN-US/ DTSUIi.exe

Microsoft SQL Server DTS Password Disclosure Vulnerability

References:

• Frequently Asked Questions: Microsoft Security Bulletin (MS00-041) (Microsoft)
  
• Microsoft SQL Server Enterprise Manager Password Disclosure Vulnerability (SecurityFocus)