Re: [dtp-dev] a critical security bug

[rcernich@xxxxxxxxxx]

Hey Anthos,

Sorry I missed this when I dispo'd the defect, but the file you are
referring to is the file which stores the driver information.  The uid and
pwd information there is used for default values when creating a new
connection profile (e.g. specifying the default uid/pwd for a particular
vendor's DB).  The information in the profile is what is used when opening
connections and is encrypted when saved to the file system.

I would recommend against storing user specific passwords in driver
instances (it's intended purpose was for specifying default values; e.g.
sa/<blank> or the default uid/pwd for sample db's/schemas shipped with the
server).  It was not intended to store specific uid/pwd combinations.  If
this is not acceptable, my recommendation would be to remove those
properties from your driver extension altogether.

Hope that helps.
Rob