-----BEGIN PGP SIGNED MESSAGE----- =============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : Jan Meijer Index : S-99-08 Distribution : World Page : 1 Classification: External Version: 1 Subject : Microsoft BackOffice Vulnerability Date : 23-Feb-99 =============================================================================== By courtesy of The U.S. Department of Energy Computer Incident Advisory Capability we received information on a vulnerability in the installer for Microsoft BackOffice Server 4.0. BackOffice Server 4.0 does not delete the installation setup file. Users who can log into the server locally would be able to access name and password for the accounts associated with the services which are part of a BackOffice 4.0 installation. CERT-NL recommends to delete the file \Program Files\Microsoft Backoffice\Reboot.ini after each BackOffice 4.0 installation, whether successful or not. ============================================================================== [ Start Microsoft Advisory ] Microsoft Security Bulletin (MS99-005) - - -------------------------------------- BackOffice Server 4.0 Does Not Delete Installation Setup File Originally Posted: February 12, 1999 Summary ======= Microsoft (R) has learned of a potential vulnerability in the installer for BackOffice Server (R) 4.0. The installer asks the user to provide the account userid and password for selected services and writes these to a file in order to automate the installation process. However, the file is not deleted when the installation process completes. As detailed below, Microsoft recommends that BackOffice 4.0 customers delete this file. Microsoft has received no reports of customers being adversely affected by this problem. However, it is releasing this security bulletin in order to proactively provide customers with information about the problem in order to allow them to take steps to ensure their safe computing. Issue ===== When a user chooses to install SQL Server (R), Exchange Server (R) or Microsoft Transaction Server (R) as part of a BackOffice 4.0 installation, the BackOffice installer program requests the name and password for the accounts associated with these services. Specifically, it asks for the account name and password for the SQL Executive Logon account, the Exchange Services Account, and the MTS Remote Administration Account. These values are stored in \Program Files\Microsoft\Backoffice\Reboot.ini, and used to install the associated services. BackOffice Server does not erase this file when the installation process is completed. This is true regardless of whether the installation process completes successfully or unsuccessfully. By default, the Microsoft BackOffice folder is not shared, so network access to reboot.ini generally does not pose a risk. Users who can log onto the server locally would be able to access the file, but in most cases this ability is granted only to selected users such as administrators. The fix for this problem is to delete the file \Program Files\Microsoft Backoffice\Reboot.ini after each BackOffice 4.0 installation, whether successful or not. The file is created only by the installer, and, once deleted, will not be re-created unless BackOffice 4.0 is re-installed. Affected Software Versions ========================== The following software versions are affected: Microsoft BackOffice Server 4.0 What Microsoft is Doing ======================= On February 12th, Microsoft sent this security bulletin to customers subscribing to the Microsoft Product Security Notification Service (see http://www.microsoft.com/security/services/bulletin.asp for more information about this free customer service). Microsoft has published the following Knowledge Base (KB) article on this issue: Microsoft Knowledge Base (KB) article Q217004, BackOffice Installer Tool Does Not Delete Password Cache File. http://support.microsoft.com/support/kb/articles/q217/0/04.asp (Note: It might take 24 hours from the original posting of this bulletin for the KB article to be visible in the Web-based Knowledge Base.) What customers Should Do ======================== Microsoft recommends that customers ensure that they delete the file \Program Files\Microsoft Backoffice\Reboot.ini after the installation program for BackOffice 4.0 completes More Information ================ Please see the following references for more information related to this issue. Microsoft Security Bulletin MS99-005, BackOffice 4.0 Does Not Delete Installation Setup File (the Web-posted version of this bulletin), http://www.microsoft.com/security/bulletins/ms99-005.asp. Microsoft Knowledge Base (KB) article Q217004, BackOffice Installer Tool Does Not Delete Password Cache File. http://support.microsoft.com/support/kb/articles/q217/0/04.asp (Note: It might take 24 hours from the original posting of this bulletin for the KB article to be visible in the Web-based Knowledge Base.) Obtaining Support on this Issue =============================== If you require technical assistance with this issue, please contact Microsoft Technical Support. For information on contacting Microsoft Technical Support, please see http://support.microsoft.com/support/contact/default.asp. Revisions ========= February 12, 1999: Bulletin Created For additional security-related information about Microsoft products, please visit http://www.microsoft.com/security - ------------------------------------------------------------------------- THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. (C) 1999 Microsoft Corporation. All rights reserved. Terms of Use. [ End Microsoft Advisory ] ______________________________________________________________________________ ================================================================================= CERT-NL wishes to thank The U.S. Department of Energy Computer Incident Advisory Capability for bringing this information to our attention ================================================================================= CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet is the Dutch network for educational, research and related institutes. CERT-NL is a member of the Forum of Incident Response and Security Teams (FIRST). All CERT-NL material is available under: http://www.surfnet.nl/surfnet/security/cert-nl.html ftp://ftp.surfnet.nl/surfnet/net-security In case of computer or network security problems please contact your local CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer please address the appropriate (local) CERT/security-team). CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer, i.e. UTC+0100 in winter and UTC+0200 in summer (DST). Email: cert-nl@surfnet.nl ATTENDED REGULARLY ALL DAYS Phone: +31 302 305 305 BUSINESS HOURS ONLY Fax: +31 302 305 329 BUSINESS HOURS ONLY Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands NOODGEVALLEN: 06 52 87 92 82 ALTIJD BEREIKBAAR EMERGENCIES : +31 6 52 87 92 82 ATTENDED AT ALL TIMES CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES: THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED* PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: cp850 iQCVAwUBNtO/wfE6s6q7Tf4RAQFi6AP+NxgEAAFDosON1JkQJ1orR3Cdad3toZ/E gelCsUAIu7vKzoFDVJwpSpDOJhtF3TCN73NK8/coYFZs2MvSfUIGy7a9dcTUbWPC OiVeQiYbRHxfGEqbQdqVUQXnPFPCeVMlgGbI/kkUgdZK5RUkmH+vJjBFvVQojBOv Lb0HcVl46x8= =N7PF -----END PGP SIGNATURE-----