ODBC Login information saved as plain text... :(

From: hanez (mailman_at_hanez.org)
Date: 07/22/03

  • Next message: Arve Bersvendsen: "Vulnerability in the mail client in Opera 7.20 beta 1." 
    To: bugtraq@securityfocus.com
Date: Tue, 22 Jul 2003 10:30:14 +0200

    (this is my second post of this mail because the first didn't arrived to the
    list...)

    Hello All,

    i have found an interesting thing in Windows XP. When i create an ODBC
    SYSTEM-DSN (Datasource available for all users) for accessing a SQL-Server,
    it is saved in the Windows Registry. The Problem there is, that Windows is
    saving the login information like username and password as plain text in the
    registry keys and every user who has access to this PC could read these
    entries.

    I don't have big problems with this but i think that many developers are using
    this for building database driven applications. If these applications are
    running on client PC's where noone should know the passwords of the database
    server, every user could read the login information in the Windows registry
    and then use an application like MS-Access to get access to the tables stored
    on the server. I think this is a very insecure thing! Users could get
    Information about the structures of the tables on the database server and
    maybe if not correct configured get write access to all tables... A horrible
    thing i think...

    I have only tested this on my Windows XP workstation and one and only Windows
    machine, so i could not test it on other versions of this stupid OS. Like i'm
    knowing M$ it is a problem in all versions of Windows. Windows simply is a
    big security problem...

    //Here is a sample of a registry entry
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI\TESTDSN]

    "Driver"="C:\\WINDOWS\\System32\\myodbc3.dll"

    "Description"="MySQL ODBC 3.51 Driver DSN"

    "Database"="test"

    "Server"="192.168.0.1"

    "User"="user_name"

    "Password"="plain_password"

    "Port"="3306"

    "Option"="3"

    "Stmt"=""
    //end

    regards
    hanez 

    -- 
A: Feel free!!!
B: Feel free? 
A: Use a free OS!
  • Next message: Arve Bersvendsen: "Vulnerability in the mail client in Opera 7.20 beta 1."

    Relevant Pages

    • Re: help with 2000i on win2k server (sp3 on database)
      ... See Leonard's post for the config options. ... If the server is mangling itself, then ANYTHING running on the server ... that I work with will support the database AND the application. ... As for Windows vs. Linux/NetWare, I can agree, but I also see MANY ...
      (comp.databases.btrieve)
    • Re: nt4.5 to w2003
      ... keep in mind that there basically is two different things you can do to move from an NT 4 (SAM Database) domain to an Active Directory Domain. ... You can choose to upgrade the domain from NT 4 to Windows 200x Active Directory. ... The thing to keep in mind here is that you have to Upgrade an NT 4 PDC to Windows 200x. ... You could download and install Virtual Server 2005 if you needed to upgrade an NT 4 machine to Windows 200x and your real hardware either does not support NT 4, or the NT 4 hardware you have does not really support Windows 200x. ...
      (microsoft.public.windows.server.migration)
    • Re: Setting up Linked server to MsAccess
      ... At the server level I have added my windows user group ... At the database level I have added my Server login ...
      (microsoft.public.sqlserver.security)
    • Problem with Sharepoint Windows Services on Win 2003 SBS Server
      ... The other day we had a server that crashed for some unknown reason. ... "Cannot connect to the configuration database. ... I should point out at this stage that the OS is Windows 2003 Small Business ... SharePoint Services 2.0 and tried re-installing MSDE by launching ...
      (microsoft.public.windows.server.sbs)
    • Re: Database Connection/ Results not working
      ... After you have created your database connection and renamed your page to .asp, ... You can not test any thing under Windows XP Home ... that requires a MS Web server, ...
      (microsoft.public.frontpage.client)