reboot.ini-passwds.txt

`Date: Fri, 12 Feb 1999 14:34:17 -0800  
From: [email protected]  
To: [email protected]  
Subject: Microsoft Security Bulletin (MS99-005)  
  
The following is a Security Bulletin from the Microsoft Product Security  
Notification Service.  
  
Please do not reply to this message, as it was sent from an unattended  
mailbox.  
********************************  
  
Microsoft Security Bulletin (MS99-005)  
--------------------------------------  
  
BackOffice Server 4.0 Does Not Delete Installation Setup File  
  
Originally Posted: February 12, 1999  
  
Summary  
=======  
Microsoft (R) has learned of a potential vulnerability in the installer for  
BackOffice Server (R) 4.0. The installer asks the user to provide the  
account userid and password for selected services and writes these to a file  
in order to automate the installation process. However, the file is not  
deleted when the installation process completes. As detailed below,  
Microsoft recommends that BackOffice 4.0 customers delete this file.  
  
Microsoft has received no reports of customers being adversely affected by  
this problem. However, it is releasing this security bulletin in order to  
proactively provide customers with information about the problem in order to  
allow them to take steps to ensure their safe computing.  
  
Issue  
=====  
When a user chooses to install SQL Server (R), Exchange Server (R) or  
Microsoft Transaction Server (R) as part of a BackOffice 4.0 installation,  
the BackOffice installer program requests the name and password for the  
accounts associated with these services. Specifically, it asks for the  
account name and password for the SQL Executive Logon account, the Exchange  
Services Account, and the MTS Remote Administration Account. These values  
are stored in <systemdrive>\Program Files\Microsoft Backoffice\Reboot.ini,  
and used to install the associated services.  
  
BackOffice Server does not erase this file when the installation process is  
completed. This is true regardless of whether the installation process  
completes successfully or unsuccessfully. By default, the Microsoft  
BackOffice folder is not shared, so network access to reboot.ini generally  
does not pose a risk. Users who can log onto the server locally would be  
able to access the file, but in most cases this ability is granted only to  
selected users such as administrators.  
  
The fix for this problem is to delete the file <systemdrive>\Program  
Files\Microsoft Backoffice\Reboot.ini after each BackOffice 4.0  
installation, whether successful or not. The file is created only by the  
installer, and, once deleted, will not be re-created unless BackOffice 4.0  
is re-installed.  
  
Affected Software Versions  
==========================  
The following software versions are affected:  
- Microsoft BackOffice Server 4.0  
  
What Microsoft is Doing  
=======================  
On February 12th, Microsoft sent this security  
bulletin to customers subscribing to the Microsoft  
Product Security Notification Service  
(see http://www.microsoft.com/security/services/bulletin.asp  
for more information about this free customer service).  
  
Microsoft has published the following Knowledge Base (KB) article on this  
issue:  
- Microsoft Knowledge Base (KB) article Q217004,  
BackOffice Installer Tool Does Not Delete Password Cache File.  
http://support.microsoft.com/support/kb/articles/q217/0/04.asp  
(Note: It might take 24 hours from the original posting of this  
bulletin for the KB article to be visible in the Web-based  
Knowledge Base.)  
  
What customers Should Do  
========================  
Microsoft recommends that customers ensure that they delete the file  
<systemdrive>\Program Files\Microsoft Backoffice\Reboot.ini after the  
installation program for BackOffice 4.0 completes  
  
More Information  
================  
Please see the following references for more information related to this  
issue.  
- Microsoft Security Bulletin MS99-005,  
BackOffice 4.0 Does Not Delete Installation Setup File  
(the Web-posted version of this bulletin),  
http://www.microsoft.com/security/bulletins/ms99-005.asp.  
- Microsoft Knowledge Base (KB) article Q217004,  
BackOffice Installer Tool Does Not Delete Password Cache File.  
http://support.microsoft.com/support/kb/articles/q217/0/04.asp  
(Note: It might take 24 hours from the original posting of this  
bulletin for the KB article to be visible in the Web-based  
Knowledge Base.)  
  
Obtaining Support on this Issue  
===============================  
If you require technical assistance with this issue, please contact  
Microsoft Technical Support. For information on contacting Microsoft  
Technical Support, please see  
http://support.microsoft.com/support/contact/default.asp.  
  
Revisions  
=========  
- February 12, 1999: Bulletin Created  
  
  
For additional security-related information about Microsoft products, please  
visit http://www.microsoft.com/security  
  
  
----------------------------------------------------------------------------  
----  
  
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS"  
WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER  
EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS  
FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS  
SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,  
INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN  
IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE  
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR  
LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE  
FOREGOING LIMITATION MAY NOT APPLY.  
  
(C) 1999 Microsoft Corporation. All rights reserved. Terms of Use.  
  
*******************************************************************  
You have received this e-mail bulletin as a result of your registration  
to the Microsoft Product Security Notification Service. You may  
unsubscribe from this e-mail notification service at any time by sending  
an e-mail to [email protected]  
The subject line and message body are not used in processing the request,  
and can be anything you like.  
  
For more information on the Microsoft Security Notification Service  
please visit http://www.microsoft.com/security/bulletin.htm. For  
security-related information about Microsoft products, please visit the  
Microsoft Security Advisor web site at http://www.microsoft.com/security.  
  
  
------------------------------------------------------------------------  
  
Date: Tue, 9 Feb 1999 13:35:58 -0500  
From: Russ <[email protected]>  
To: [email protected]  
Subject: Alert: REBOOT.INI exposes passwords in plaintext  
  
The Microsoft BackOffice 4.0 Setup utility creates a file called  
REBOOT.INI in the  
  
\Program Files\Microsoft BackOffice  
  
directory which contains plaintext userIDs and Passwords for, at least,  
the SQL Executive Logon account, the Exchange Services Account, and the  
MTS Remote Administration Account, if supplied during BackOffice Setup.  
Other user account passwords may be recorded in this file during setup  
as well, however my investigations have so far only revealed those  
mentioned.  
  
This file is created and stored with EVERYONE: FULL CONTROL permissions.  
  
Obviously this represents a significant risk for BackOffice servers that  
allow console logons by non-Administrators and/or remote access to the  
\Program Files directory.  
  
[email protected] was informed of this vulnerability well over a week  
ago. To date, however, they say they have not been able to identify the  
application that creates the file, or the owners of the vulnerability.  
  
Such a response is unacceptable and represents a clear problem in their  
process of handling vulnerabilities (even if they have been busy  
recently, the fact they still say they don't know what application  
creates the file is a big problem).  
  
Another potential vulnerability exists in this same directory.  
REGEDIT.EXE is stored there with EVERYONE: FULL CONTROL permissions.  
Although proper permissioning of the registry should prevent  
inappropriate access to it, control over this executable is usually also  
desired. There's no reason that this file should exist in this directory  
given it should be accessible via the normal path environment variable,  
so its existence could allow someone to attempt to use it without  
auditing or the permission controls that might normally be applied to  
executables in the \systemroot directory tree.  
  
Cheers,  
Russ - NTBugtraq moderator  
  
-----------------------------------------------------------------------  
  
Date: Fri, 12 Feb 1999 16:29:31 -0500  
From: Russ <[email protected]>  
To: [email protected]  
Subject: Re: Alert: REBOOT.INI exposes passwords in plaintext  
  
Microsoft have released a Security Bulletin  
(http://www.microsoft.com/security/bulletins/ms99-005.asp) which  
confirms the issues raised in the NTBugtraq message posted on 2/9/99;  
  
http://www.ntbugtraq.com/page_archives_wa.asp?A2=ind9902&L=ntbugtraq&F=P  
&S=&P=2326  
  
regarding the existence of the REBOOT.INI file and it possibly  
containing plaintext passwords with userIDs.  
  
I would like to acknowledge and thank Angelo Maggio who originally  
discovered this potential problem and reported it to me after reporting  
it to Microsoft.  
  
Cheers,  
Russ - NTBugtraq moderator  
  
`