FIX: Passwords May Be Retrieved from Enterprise Manager and from a DTS Package with No Owner Password (264880)

SYMPTOMS

It may be possible to use a third-party utility to retrieve a password, stored in an edit box and masked behind asterisks. This problem could occur in SQL Server Enterprise Manager and in a Data Transformation Services (DTS) package. If a DTS package is saved without an owner password, any user with permissions to access the location where the package is stored (that is, SQL Server, the Repository, or a file) can edit that package to view the password if the DTS package contains tasks that store a password, such as a connection to an OLE DB or ODBC data source, Send Mail, or Transfer Objects task. A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that are experiencing this specific problem. This fix may receive additional testing. Therefore, if you are not severely affected by this problem, Microsoft recommends that you wait for the next SQL Server service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The typical support costs will apply to additional support questions and issues that do not qualify for the specific update in question.


Microsoft SQL Server 7.0 Service Pack 2 must already be installed prior to applying this fix.
The English version of this fix should have the following file attributes or later:

Version      File name   Platform
---------------------------------

7.00.886     DTSUI.dll   x86
7.00.886     Sqlns.dll   x86
7.00.886     DTSUI.dll   Alpha
7.00.886     Sqlns.dll   Alpha
				

NOTE: Due to file dependencies, the most recent hotfix or feature that contains the preceding files may also contain additional files.

Steps to Install the Fix

To install the fix, perform the following steps:

1. Read Microsoft Security Bulletin MS00-041 Frequently Asked Questions, located at the following Web site:

   http://www.microsoft.com/technet/security/bulletin/fq00-041.mspx

   You are only required to download this patch if none of the listed workarounds in the security bulletin represents an acceptable workaround for your specific configuration.
2. Download the appropriate version of the patch for your hardware platform by clicking the link to the file in the Microsoft Download Center.
   
   Microsoft SQL Server 7.0 on x86:
   
   Download DTSUIi.exe now
   
   Microsoft SQL Server 7.0 on Alpha:
   
   Download DTSUIa.exe now
3. Run the self-extracting executable file to obtain the patch. During the extraction process, you will be prompted to specify a destination directory for the files.NOTE: Both the Alpha and x86 versions of the patch must be extracted by running on an x86-based system.
   
   
4. In Microsoft Windows Explorer, navigate to the Mssql7\Binn folder and rename the existing DTSUI.dll and Sqlns.dll files. Replace the existing DTSUI.dll and Sqlns.dll files with the version that you extracted in Step 3. Repeat this on all client workstations that you use to edit DTS packages.