Security Bulletin
Microsoft Security Bulletin MS01-019 - Critical
Passwords for Compressed Folders are Recoverable
Published: March 28, 2001 | Updated: June 23, 2003
Version: 1.2
Originally posted: March 28, 2001
Updated: June 23, 2003
Summary
Who should read this bulletin:
Customers using the Compressed Folders feature in Microsoft® Plus! 98 and Windows® Me.
Impact of vulnerability:
Data compression passwords can be recovered.
Recommendation:
Customers who password-protect their compressed folders should apply the patch and delete c:\windows\dynazip.log.
Affected Software:
- Microsoft Plus! 98
- Microsoft Windows Me
General Information
Technical details
Technical description:
Plus! 98, an optional package that extends Windows 98 and Windows 98 Second Edition, introduced a data compression feature called Compressed Folders that was also included in Windows Me. For interoperability with leading third-party compression tools, it provides a password protection option for folders that have been compressed. However, due to a flaw in the package's implementation, the passwords used to protect the folders are recorded in a file on the user's system. If an attacker gained access to an affected machine on which password-protected folders were stored, she could learn the passwords and access the files.
It is important to understand that, although this flaw does constitute a security vulnerability, the password protection feature is not intended to provide strong security. It was included in the products to enable interoperability with password-protection features in other third-party data compression products, and is only intended to provide protection against casual inspection. Customers who need strong protection for files should use Windows® 2000.
The patch will prevent passwords from being written to the user's system in the future. However, as discussed in the FAQ, after applying the patch, it is important to also delete c:\windows\dynazip.log, in order to ensure that all previously-recorded passwords are deleted.
Mitigating factors:
- The password mechanism at issue here is not related in any way to the network authentication mechanism. It is used solely for password-protecting compressed folders.
- An attacker would require physical access to an affected system in order to recover the password, or the owner of the machine would need to have deliberately shared out the c:\windows folder.
Vulnerability identifier: CAN-2001-0152
Tested Versions:
Microsoft tested Windows Me and Plus! 98 to assess whether they are affected by these vulnerabilities. The data compression feature did not exist prior to these products.
Frequently asked questions
What's the scope of the vulnerability?
Windows Me and Plus! 98 (an add-on package for Windows 98 and Windows 98 Second Edition) provide an optional feature that can be used to password-protect folders after they have been compressed. This vulnerability could divulge the passwords used to protect these folders. If an attacker had access to the password-protected folders on an affected machine, she could use the vulnerability to read or change them.
Although the passwords should clearly not be available on the system, it is important to keep this issue in perspective. The passwords at issue here are involved solely with password-protecting compressed files - they are are not related in any way to the user's logon password. Also, the password protection protection feature is not intended to act as an access control mechanism - it is provided for solely for compatibility with third-party products' password mechanisms. Even after applying this patch, the password protection feature here only provides protection against casual scrutiny. Customers who need strong security, including strong access controls, should consider using Windows 2000.
What causes the vulnerability?
Windows Me and Plus! 98 provide a data compression feature that allows a compressed folder to be password-protected. However, under certain conditions, the password can be recorded in a file on the user's system.
What's Plus! 98?
Plus! 98 is an optional package that provides additional functionality to Windows 98 and Windows 98 Second Edition. In addition to including the data compression feature at issue here, it also provide a virus scanner, a disk cleaning feature, several games, and other features.
What's the data compression feature, and how is password protection related to it?
Both Plus! 98 and Windows Millenium provide a feature called Compressed Folders, that can be used to compress folders and the files within them as a way of saving disk space. The Compressed Folders feature uses the same algorithm as several popular third-party utilities. However, it is more convenient than third-party tools - the user can select whether or not a folder should be compressed via the Properties page.
The feature also allows the user to password-protect compressed folders, and this is where the vulnerability lies. By design, the passwords should never be recorded. However, in actuality, the passwords are logged in a file on the user's system.
How could an attacker exploit this vulnerability?
If an attacker had physical access to a machine, she could read the passwords and access any password-protected compressed folders on the system.
Would this password enable the attacker to log onto my network?
The password at issue here is used solely by the Compressed Folders feature. It is completely separate from any other password, including the network logon password. It is possible for a user to choose any desired value for this password, but it's extremely bad practice to use the same password in multiple places.
How serious is this vulnerability?
Although storing the passwords on the system clearly is a security vulnerability, it's important to understand that the password protection feature is not intended to provide strong security. It's only intended to protect the contents of the file against casual inspection. By design, Windows 98 and Me do not provide an access control mechanism, and this feature not intended to function as one. Customers who need strong access control should consider Windows NT® or Windows 2000.
If the option isn't intended to provide strong security, why is it provided?
One of our primary design goals for the Compressed Folders feature was interoperability with leading third-party compression tools. To accomplish this, we chose to implement the same feature set as they do, using compatible compression and password algorithms.
I haven't installed Plus! 98, but I use Windows 98. Could I be affected by this vulnerability?
No. The data compression feature isn't included in Windows 98 or Windows 98 Second Edition. Customers using these products could only be affected if they've installed the Plus! 98 package on their systems.
I use Windows 95. Could I be affected by the vulnerability?
No. The Compressed Folders feature was not included in Windows 95.
Is Plus! 95 affected by the vulnerability?
No. The data compression feature doesn't ship as part of Windows 95, nor as part of Plus! 95.
Would it be possible for a Windows 95 user to install Plus! 98?
No. Plus! 98 will only install on a system running Windows 98 or Windows 98SE.
Who should use the patch?
Microsoft recommends that customers who use Windows Me or Plus! 98 and who use the password protection feature on compressed folders consider applying the patch.
What does the patch do?
The patch eliminates the vulnerability by preventing the passwords from being written to the disk.
After applying the patch, is there anything else I need to do?
Yes. Applying the patch will prevent future passwords from being stored on the system, but you'll still need to remove any that have previously been stored. To do this, use Windows Explorer to delete the file c:\windows\dynazip.log.
Patch availability
Download locations for this patch
Additional information about this patch
Installation platforms:
This patch can be installed on Windows 98 and Windows 98SE systems on which Plus! 98 has been installed. It also can be installed on Windows Me Gold systems.
Inclusion in future service packs:
Service pack plans for Windows Me have not yet been finalized. However, if a service pack for Windows Me is produced, the fix for this issue will be included in it.
Verifying patch installation:
Plus! 98:
Verify that the version information for zipfldr.dll is 5.0.526.20 on Japanese/NEC systems, and 5.0.518.20 for all other languages.
Windows Me:
Verify that the version information for zipfldr.dll is 5.50.4213.1600.
Caveats:
None
Localization:
Localized versions of this patch are available. Microsoft Knoweldge Base article Q252694 provides links to the localized versions.
Obtaining other security patches:
Patches for other security issues are available from the following locations:
- Security patches are available from the Microsoft Download Center, and can be most easily found by doing a keyword search for "security_patch".
- Patches are also available from the WindowsUpdate web site
Other information:
Support:
- Microsoft Knowledge Base article Q252694 discusses this issue and will be available approximately 24 hours after the release of this bulletin. Knowledge Base articles can be found on the Microsoft Online Support web site.
- Technical support is available from Microsoft Product Support Services. There is no charge for support calls associated with security patches.
Security Resources: The Microsoft TechNet Security Web Site provides additional information about security in Microsoft products.
Disclaimer:
The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Revisions:
- V1.0 (March 28, 2001): Bulletin Created.
- V1.1 (April 04, 2001): Modified first bullet in Mitigating Factors to clarify that the password mechanism is separate from the authentication mechanism.
- V1.2 (June 23, 2003): Updated Windows Update download links.
Built at 2014-04-18T13:49:36Z-07:00 </https:>