ms.siteserver.3.0.adsamples.txt

`Date: Tue, 11 May 1999 16:27:38 -0600  
From: Mark <[email protected]>  
To: [email protected]  
Subject: [ALERT] Site Server 3.0 May Expose SQL IDs and PSWs  
  
====================================================  
Site Server's AdSamples Directory Reveals ID and PSW  
Discovered by Andrey Kruchkov  
====================================================  
  
VERSIONS EFFECTED  
  
* Tested on Microsoft Site Server 3.0 Commerce Edition  
  
DESCRIPTION  
  
Site Server allows the installation of an AdSamples directory, which serves  
to demonstrate the capabilities of the Ad Server component. If this  
directory is installed and left open to the public without limiting  
directory permissions, a user can obtain a site configuration file  
(SITE.CSC) that contains sensitive information pertaining to an SQL  
database. This information could contain a DSN, as well as a a username and  
password used by the Ad Server to access the SQL server database.  
  
COMMENTS  
  
Andrey reported this problem to NTSECURITY.NET and has informed Microsoft of  
this issue.  
  
Andrey points out an easy way to eliminate this risk:  
  
Remove the "AdSamples" virtual directory from the DEFAULT root Web site, or  
change security permissions for this folder to sufficiently restrict access.  
If you must provide loose access to this virtual directory for some strange  
reason, then you should at least adjust the security permissions for the  
SITE.CSC file so that it's not available for viewing. Also keep in mind that  
there may be numerous other SITE.CSC files under your Site Server  
installation, all of which need to be secured.  
  
For a URL that demonstrates the problem, please visit  
http://www.ntsecurity.net/scripts/loader.asp?iD=/security/siteserver-2.htm  
  
This is probably a great time to remind people once again to NEVER install  
sample content on production servers and to NEVER use the built-in IIS  
DEFAULT Web site without first thoroughly investigating the implications of  
doing so.  
  
Thanks,  
Mark - http://www.ntsecurity.net  
  
`