Well, I'm not sure, but my tests show that it is dependant on the MDAC's
installed. When a program needs access to a database, it calls upon a DSN.
The DSN is an entry in the ODBC database that tells the ODBC driver where
the database is located, the name of the DSN, etc. At this point, ODBC
handles the communications between the application and the database,
basically the translator between the two. If you upgrade to MDAC 2.1, and go
to Control Panel->ODBC, and then click on the "Drivers" tab, you will see a
list of drivers for each database type. When you install the MDAC 2.1, the
Access ODBC driver will get updated to 2/xx/99 (don't remember the specific
date). Once you do that, the script I have written stops working. Again, I
am not an authority on this, just a lowly sys. admin. who likes his machines
secure! ;)
The test script I wrote uses a database (exploit.mdb) that was created with
Access 97. This exploit worked 100% until I installed the 2.1 MDAC's. From
that point on, the script will not work (it doesn't give an error, but it
also doesn't do what it was written to do).
I am by no means an expert. I have been in contact with Rain Forest Puppy
(who originally posted this to Bugtraq) and he is testing what I have found.
Hopefully he will post a follow up to his advisory. The best I can tell you
is watch Bugtraq and see what else develops.
By the way, I had a tremendous response to people wanting the test script.
You can get it from http://users.netropolis.net/src/nt-odbc/.
Scott R. Chrestman
Vice President
Netropolis Communications Corp.
E-Mail: [EMAIL PROTECTED]
http://www.netropolis.net
�
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of James
> Strompolis
> Sent: Thursday, May 27, 1999 11:54 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [IMail Forum] ODBC security flaw with NT IIS
>
>
> Scott,
>
> Doesn't Access 97 still use Jet 3.5 even if Jet 4.0 is installed? If
> true, this means that these people running IMail with Access 97 as their
> back end database would still be vulnerable. Correct me if I've got this
> wrong. Thanks for the reply.
>
> James Strompolis
> Aleph Consultants, Inc.
> [EMAIL PROTECTED], http://www.ribs.com
>
>
> ----- Original Message -----
> From: Scott R. Chrestman <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Thursday, May 27, 1999 11:39 AM
> Subject: RE: [IMail Forum] ODBC security flaw with NT IIS
>
>
> > I have been working with Rain Forest Puppy researching this....
> >
> > It looks like you will only be affected if you are running an MDAC older
> > than 2.0. The Jet Database Engine 3.51 is the engine that had the
> > exploitable vulnerability. Jet Database Engine 4.0 corrects this. RFP
> > should be releasing an update to Bugtraq in the next day or so.
> >
> > I have written a test exploit .asp script that will test to see
> if you are
> > vulnerable. You can e-mail me directly for a copy of the test script.
> >
> > Scott R. Chrestman
> > Vice President
> > Netropolis Communications Corp.
> > E-Mail: [EMAIL PROTECTED]
> > http://www.netropolis.net
> >
> >
>
>
>
>
