Vulnerability Development mailing list archives

Has anyone verified whether is is valid?


From: lurker () ITIS COM (M J)
Date: Fri, 14 Apr 2000 14:55:19 -0000


Friday's top stories
Microsoft admits security flaw
By CBS MarketWatch
Last Update: 9:07 AM ET Apr 14, 2000
NEW YORK (CBS.MW) -- Microsoft (MSFT </data/squote.htx?
TICKER=MSFT&TABLES=table&SOURCE=htx/http2_mw&dist=newsq>:
news <http://www.marketwatch.newsalert.com/bin/headlines?
Query=MSFT&SearchOption=ticker>, msgs
<http://messages.marketwatch.com/mwclub/tickerLink.asp?
ticker=MSFT&dist=newsm>) acknowledged Thursday that its
engineers included in some of its Internet software a
secret password -- a phrase deriding their rivals at
Netscape as "weenies" -- that could be used to gain illicit
access to hundreds of thousands of Internet sites world-
wide. The manager of Microsoft's security-response center,
Steve Lipner, acknowledged the online-security risk in an
interview Thursday and described such a backdoor password
as "absolutely against our policy" and a firing offense for
the as yet unidentified employees. The company planned to
warn customers as soon as possible with an e-mail bulletin
and an advisory published on its corporate Web site.
Microsoft urged customers to delete the computer file-
called "dvwssr.dll"-containing the offending code. The file
is installed on the company's Internet-server software with
Frontpage 98 extensions. While there are no reports that
the alleged security flaw has been exploited, the affected
software is believed to be used by many Web sites. By using
the so-called back door, a hacker may be able to gain
access to key Web-site management files, which could in
turn provide a road map to such things as customer credit-
card numbers, said security experts who discovered the
password.

-Matthew


Current thread: