Date: Tue, 11 May 1999 16:27:38 -0600 From: Mark To: BUGTRAQ@netspace.org Subject: [ALERT] Site Server 3.0 May Expose SQL IDs and PSWs ==================================================== Site Server's AdSamples Directory Reveals ID and PSW Discovered by Andrey Kruchkov ==================================================== VERSIONS EFFECTED * Tested on Microsoft Site Server 3.0 Commerce Edition DESCRIPTION Site Server allows the installation of an AdSamples directory, which serves to demonstrate the capabilities of the Ad Server component. If this directory is installed and left open to the public without limiting directory permissions, a user can obtain a site configuration file (SITE.CSC) that contains sensitive information pertaining to an SQL database. This information could contain a DSN, as well as a a username and password used by the Ad Server to access the SQL server database. COMMENTS Andrey reported this problem to NTSECURITY.NET and has informed Microsoft of this issue. Andrey points out an easy way to eliminate this risk: Remove the "AdSamples" virtual directory from the DEFAULT root Web site, or change security permissions for this folder to sufficiently restrict access. If you must provide loose access to this virtual directory for some strange reason, then you should at least adjust the security permissions for the SITE.CSC file so that it's not available for viewing. Also keep in mind that there may be numerous other SITE.CSC files under your Site Server installation, all of which need to be secured. For a URL that demonstrates the problem, please visit http://www.ntsecurity.net/scripts/loader.asp?iD=/security/siteserver-2.htm This is probably a great time to remind people once again to NEVER install sample content on production servers and to NEVER use the built-in IIS DEFAULT Web site without first thoroughly investigating the implications of doing so. Thanks, Mark - http://www.ntsecurity.net