Money Password Vulnerability

A security vulnerability exists in Microsoft® Money which could allow a malicious user to obtain the password of a Money data file.

Issue

Microsoft Money provides a password protection feature that prevents unauthorized access to your Money file. However, due to the way the password is currently handled, the password may be written in plaintext under certain conditions.

The vulnerability only affects Money data stored on the user's local computer - it does not affect the security of Money's online services in any way. Moreover, a malicious user would need to gain physical access to an affected file in order to exploit the vulnerability - it could not be exploited remotely. It's important to note that password protection in Money is not intended to be a substitute for file-level access control, and even in the absence of this vulnerability, customers need to protect such files.

Affected Products

• Microsoft Money 2000 & 2001

Solution

This patch is available for automatic download using the "Update Internet Information" feature in Money.

1. On the Tools menu, click Update Internet Information.
2. Follow the instructions on the screen to install the patch.
3. Users should change their password after applying this fix as a best practice.

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: August 25, 2000

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<