Jet 3.5 Text IISAM Allows Users to Append Lines to System Files |
The information in this article applies to:
-
Microsoft Access 97
-
Microsoft Office Pro 97
-
Microsoft ODBC Driver for Access, version 3.5
Novice: Requires knowledge of the user interface on single-user computers.
SYMPTOMS
The Text IISAM allows you to manipulate text files without checking the file name extension. This creates a potential security risk because it can be used to read or write to a system text file.
CAUSE
The Text IISAM is able to modify the contents of text files that are formatted as data tables. This feature makes it easy for you to exchange data on different systems.
RESOLUTION
Install the latest update to the Microsoft Jet database engine. The following registry key is dynamically added when a program loads the Text IISAM. This registry key prevents this type of security risk.
HKEY_LOCAL_MACHINE\Software\Microsoft\Jet\3.5\Engines\Text\DisabledExtensions
For additional information about how to obtain the Microsoft Jet 3.51 update, please click the article number below to view the article in the Microsoft Knowledge Base:
Q172733 ACC97: Updated Version of Microsoft Jet 3.5 Available on MSL
STATUS
Microsoft has confirmed this to be a problem in the Microsoft products listed
at the beginning of this article.
MORE INFORMATION
There could be a possible security risk when someone uses the Text IISAM to modify any of the system text files, such as Autoexec.bat, Config.sys, System.ini, and so on.
After you install the updated version of Jet, you will not be able to use the Text IISAM to update text files with the following extensions:
- bat
- cmd
- ini
- sys
- inf
- vbs
- js
These are the default extensions that are added to the registry key listed in the "Resolution" section.
Additional query words:
pra
Keywords : kbdta
Version : WINDOWS:3.5,97
Platform : WINDOWS
Issue type : kbbug
