Scott and others,
Uhh, thanks for the primer on ODBC and DSNs. I'm not trying to be snotty.
I'm a bit further along than needing the background info. Do a web search
for my mail address or last name. AltaVista comes up with a few hits. NT
Security and network security in general is a passion of mine.;) Looks like
everything you've said appears to be true as things are panning out on this.
I've tried your script already but am hesitant to install MDAC 2.1 on a
stable production machine for fear of what else it might break. We are
dealing with MSFT after all.;)
I'm not using Access for IMail (still testing it) but do "other things"
with Access and IIS. I notified a large NT mail list of the availabilty of
your script. You may get a few more hits in the next few hours.
Everyone interested in this issue may wish to follow this link before
installing MDAC 2.1:
http://www.microsoft.com/data/MDAC21info/MDAC21GAmanifest.htm
James Strompolis
Aleph Consultants, Inc.
[EMAIL PROTECTED], http://www.ribs.com
----- Original Message -----
From: Scott R. Chrestman <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, May 27, 1999 3:05 PM
Subject: RE: [IMail Forum] ODBC security flaw with NT IIS
> Well, I'm not sure, but my tests show that it is dependant on the MDAC's
> installed. When a program needs access to a database, it calls upon a
DSN.
> The DSN is an entry in the ODBC database that tells the ODBC driver where
> the database is located, the name of the DSN, etc. At this point, ODBC
> handles the communications between the application and the database,
> basically the translator between the two. If you upgrade to MDAC 2.1, and
go
> to Control Panel->ODBC, and then click on the "Drivers" tab, you will see
a
> list of drivers for each database type. When you install the MDAC 2.1,
the
> Access ODBC driver will get updated to 2/xx/99 (don't remember the
specific
> date). Once you do that, the script I have written stops working. Again,
I
> am not an authority on this, just a lowly sys. admin. who likes his
machines
> secure! ;)
>
> The test script I wrote uses a database (exploit.mdb) that was created
with
> Access 97. This exploit worked 100% until I installed the 2.1 MDAC's.
From
> that point on, the script will not work (it doesn't give an error, but it
> also doesn't do what it was written to do).
>
> I am by no means an expert. I have been in contact with Rain Forest Puppy
> (who originally posted this to Bugtraq) and he is testing what I have
found.
> Hopefully he will post a follow up to his advisory. The best I can tell
you
> is watch Bugtraq and see what else develops.
>
> By the way, I had a tremendous response to people wanting the test script.
> You can get it from http://users.netropolis.net/src/nt-odbc/.
>
> Scott R. Chrestman
> Vice President
> Netropolis Communications Corp.
> E-Mail: [EMAIL PROTECTED]
> http://www.netropolis.net
>
>
>
