Secunia

A vulnerability and a security issue have been reported in Microsoft Commerce Server, which can be exploited by malicious users to gain knowledge of sensitive information and by malicious people to bypass certain security restrictions.

1) The password for the SQL Server backend is stored encoded in the registry in the key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Commerce Server" if authentication has been configured to SQL Server authentication. However, this registry key has weak permissions allowing any user to read the encoded password.

By decoding the password, a malicious user could gain knowledge of the administrative SQL Server password.

The vulnerability has been reported in version 2002. Other versions may also be affected.

2) An error in the sample files within the "AuthFiles" directory can be exploited to bypass authentication and logon as a valid user without knowing the password.

Successful exploitation requires knowledge of a valid user name.

The security issue has been reported in version 2002. Prior versions may also be affected.

Solution
Set proper ACL permissions on the registry key.
Further details available in Customer Area

Provided and/or discovered by
1) Cesar Cerrudo
2) Dimitri van de Giessen

Changelog
Further details available in Customer Area

Original Advisory
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/csvr2002/htm/cs_se_securityconcepts_cbgw.asp

Deep Links
Links available in Customer Area