siteserver.directmail.passwd.txt

`From: The Hidden <[email protected]>  
Subject: SiteServer(SS) 3.0 Direct Mail(DM), Password in jobs  
  
When you create a DM job in SS it creates a file at the  
following location. \\Machine\TMLBQueue\Schedule\ The  
file is binary with embedded UNICODE text. If you open  
the file with notepad you can see the account name and  
password that the job runs under in clear text. The  
share is created when you install DM and has everyone  
full control permissions. The account that is in the  
file is most likely an admin, if not a domain admin  
because SS recommends a domain account to be used.  
  
Given the general lack of quality in SS I was not  
surprised to see a plain text password kicking around,  
there are probably many more places.  
  
The Hidden  
  
`