Money: Description of the Money Password Security Update (272232)

SUMMARY

This article describes the Money Password Security Update for Microsoft Money 2000 and Microsoft Money 2001.

Microsoft Money provides a password protection feature that prevents unauthorized access to a Money file. However, because of the method that Money currently uses to store the password in the Money data file, the password may be written in plain text under certain conditions.

This vulnerability only affects Money data that is stored on the local computer. It does not affect the security for the Online Services feature of Money.

In addition, to exploit the vulnerability, a malicious user would need to gain physical access to an affected Money data file. As a result, this vulnerability cannot be exploited remotely.

NOTE: Password protection in Money is not intended to be a substitute for file-level access control, and even in the absence of this vulnerability, you must protect your sensitive files. Microsoft recommends that you follow best practices when you secure your computer, including ensuring that any computer that contains important data is physically secure, and that important data files are not shared with untrusted or unknown users.

Microsoft has released the Money Password Security Update to fix this vulnerability. Microsoft recommends users change their password after applying this fix as a best practice.

The Money Password Security Update is available for automatic download using the Update Internet Information feature of Money. To receive the latest updates for Money, update your Money Internet information:

1. On the Tools menu, click Update Internet Information.
2. In Money 2000, follow the instructions on the screen to install the Money Password Security update.
   
   In Money 2001, the update is silent and automatically takes effect the next time that you start Money.