CRS Doesn't Strip ACL If No Valid SID for an Access Denied ACE

Last reviewed: February 3, 1998
Article ID: Q164803
The information in this article applies to:
  • Microsoft Commercial Internet System, version 1.0

SYMPTOMS

If the content replication server (CRS) is unable to find a valid SID on the target server during an ACL replication, it will remove the failed access control entry (ACE) from the ACL but keep the successful ACEs in the ACL. This creates a security hole if the ACE in question was an access denied ACE. Under this condition, it is possible for the SID to actually be granted access to the files, contrary to the intention of the administrator, if the same SID is a member of a successfully processed ACE that is granted permission.

RESOLUTION

This is a bug in the release version of MCIS 1.0. It is fixed by MCIS 1.0 Service Pack 1. Now if CRS is unable to find a valid SID it will check to see if the SID is assigned to a Access Denied ACE. If so, CRS strips all ACEs from the ACL and grants permission only to the Administrator. If the CE is not Access Denied, it removes only that particular ACE from the ACL. For more information on how CRS replicates ACLs, refer to the MCIS Resource Kit.

STATUS

Microsoft has confirmed this to be a problem in Commercial Internet System, version 1.0. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.

Version           : 1.0
Platform          : WINDOWS
Issue type        : kbbug
Solution Type     : kbfix


================================================================================


THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Last reviewed: February 3, 1998
© 1998 Microsoft Corporation. All rights reserved. Terms of Use.