A vulnerability was reported in Microsoft's SQL Server software. When Data Transformation Service (DTS) packages are created, database passwords may be disclosed within the package. A user receiving a DTS package may obtain the SQL Server database password of the user that created the package. It is reported that the saved file does not encrypt the passwords that the package will use when executed. As a result, the password of the user creating the package may be disclosed to the recipient of the DTS package.

There was no solution available from Microsoft at this time. It is suggested that using a sensitive user account to create DTS packages would not be advised.

Reported by: "Floyd Russell"