DOCSLIB.ORG

WINDOWS 2000 SECURITY Windows 2000 Security - an Overview and Analysis Part 1 13 Dr

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
WINDOWS 2000 SECURITY Windows 2000 Security - an Overview and Analysis Part 1 13 Dr WINDOWS 2000 SECURITY Windows 2000 Security - An Overview and Analysis Part 1 13 Dr. Jesper M. Johansson Introduction and History States Department of Defense’s Trusted Com- On February 17, 2000 Microsoft released the puter Systems Evaluation Criteria (TCSEC) C2 newest version of its “industrial strength” oper- classification [1]. These requirements dictate that ating system, Windows NT. This version, origi- the trusted computing base must provide three nally named Windows NT 5.0, was renamed security measures: Windows 2000 about half-way through the beta cycle. Although the name change appears to - User identification have been largely a marketing move, it has - User accountability caused no small amount of confusion for users. Many still believe that Windows 2000 is essen- - Object security tially a “better Windows 98.” Nothing could be These same features are part of the new Com- further from the truth. Contrary to Windows 95 mon Criteria that is replacing the TCSEC as the and 98, both of which have virtually no mean- preferred security evaluation criteria. Windows ingful security mechanisms, Windows 2000 is an 2000 has elements of at least the following secu- upgrade to Windows NT 4.0. Windows NT 4.0 rity functional requirements [2]: was designed with a security model in mind; Windows 2000 modifies and extends this model. Hence, a discussion of the security features of FAU_GEN Security audit data generation Windows 2000 is highly meaningful and rele- FAU_SAR Security audit review vant. In this first part of a paper on this subject I FDP_ACC Access control policy present the security model of Windows 2000 as it relates to three basic components of security: FDP_ACF Access control functions user identification, user accountability, and ob- FDP_RIP Residual information protection ject security. FIA_AFL Authentication failures Windows 2000 is quite possibly the most com- plex operating system ever built. It follows that FIA_ATD User attribute definition the security related features are exceedingly FIA_UAU User authentication complex as well. In this paper I will not try to FIA_UID User identification cover all security related features of Windows 2000. To do so would require a few books. Nor FIA_USB User-subject binding am I trying to expose all security related vulnera- bilities in Windows 2000. No one could do that Note that no formal evaluation of Windows 2000 at this early stage. I am simply setting out to with respect to any formal security criteria has been evaluate how the most fundamental tenets of performed. By listing formal requirements I thus InfoSec, user identification, accountability, and do not mean to imply that Windows 2000 is en- object security, are designed and implemented tirely compliant with them. However, Windows in Windows 2000. Each section covers a specific 2000 does at least meet elements of these func- topic. Section 2 contains a review of the Win- tional requirements. Whereas in Windows NT 4.0 dows 2000 security model, and Section 3 dis- both accountability and object security are op- cusses how user identification information is tional during setup, user identification in addi- managed in Windows 2000. The next and final tion to these two requirements is optional in paper in the series looks at how it is possible to Windows 2000. A given system does not have to restrict and audit access once users are identi- enforce any of them, although for the remainder fied. The second paper also presents some obser- of this paper we will assume that a system is vations and conclusions. configured to do so. The Security Model in Windows 2000 Security Requirements and Windows 2000 Windows 2000 is based on the same security The most basic requirement for any secure sys- model as its predecessor, Windows NT 4.0. That tem is user identification. In Windows 2000, user model, originating with the first release of Win- identification is optional. During setup, the per- dows NT, is designed from the ground up to son installing the system is asked whether the match the security requirements of the United system should automatically log on a user at Information Security Bulletin July 2000, Page 13 WINDOWS 2000 SECURITY startup. This could also be done in Windows NT accounts; these are now tracked in the Active Di- 4.0, but is not configured during setup. If auto- rectory (AD). The term Active Directory is really a matic logon is selected, all user identification is marketing term denoting the database that orga- effectively disabled and further security mea- nizes and stores user account information for a sures based on user identification, such as object Windows 2000 domain. It consists of two parts; security and user accountability, are meaning- the storage mechanism itself, and a location less. However, if the system is configured to re- mechanism used to locate entries in the data- quire a logon, it can track user accounts. These base. The database, stored in a file called ntds.dit, accounts can be managed either locally on the is managed by the Extensible Storage Engine workstation, or by a network server known as a (ESE), which is also used in Microsoft Exchange. domain controller (DC). Local accounts are usable That engine, in turn, is based on the Microsoft Jet only to connect to the workstation or server Engine. Access to the data store is accomplished where they are defined. They are stored in a almost exclusively through the Directory System portion of the Registry database on the local sys- Agent (ntdsa.dll). The only exception is that tem. This portion of the Registry is readable only Messaging API (MAPI) clients may access the da- by registered operating system components, and tabase layer directly. The main interfaces to the contains all information about each user’s ac- directory are either the Lightweight Directory Ac- count, including the password representations. If cess Protocol (LDAP) [3] or Active Directory Services network accounts are used, the computer must Interface (ADSI). ADSI is an API that provides an be a member of a domain. A domain is a group- interface to LDAP from a wide range of lan- ing of systems that share a common user ac- guages, such as C++, Visual Basic, Visual Basic count database. Accounts are managed by the Script, JavaScript, and others. Security Accounts Manager (SAM), which manages the SAM Database. Under Windows NT 4.0, the The Active Directory is created when the first domain accounts database was stored in the server is promoted to become a DC. At that time, Registry of the DCs, just like a local database. the SAM database is replaced by a “stub SAM;” However, in Windows 2000 it is stored in the Ac- the Registry-based SAM database on a DC holds tive Directory, which is described below. only a few security accounts. All the operational accounts are now stored in AD. The few ac- counts left in the SAM are used when the DC is Windows 2000 File Systems started in Directory Services Restore mode. The Windows 2000 supports three disk file systems: disposition of the accounts in the SAM when a 16-bit File Allocation Table (FAT16), 32-bit File Allo- server is promoted depends on whether a new cation Table (FAT32), and the New Technology File domain was created, or whether the server was System (NTFS) version 5.0. The first two file sys- added to an existing domain. If the server is pro- tems hail from the days of MS-DOS. FAT16 is the moted to manage a new domain, the accounts in file system supported under MS-DOS, and the SAM become accounts in the new AD do- DOS-based operating systems, such as Windows main. If the server is added to an existing do- 95. However, FAT16 limits partition sizes to 2 main, the local accounts are removed. gigabytes (4 on Windows NT) and therefore a 32-bit version of FAT was developed for a service Objects in Active Directory are uniquely identi- release of Windows 95. FAT32 supports volumes fied by a Globally Unique Identifier (GUID). In pre- as large as 2 terabytes, although the maximum vious versions of Windows NT objects were size volume that can be formatted under Win- identified by a Security Identifier (SID). However, dows 2000 is 32 GB. This is not a technical limita- the Active Directory stores entries from several tion, but rather a limitation related to the Win- domains, and it is possible that SIDs are identical dows 2000 format command. Windows 2000 can across domains. Each object still has a SID, but access larger FAT32 volumes created under Win- the SIDs are no longer static. A SID for a particu- dow 98. NTFS should, however, be used on all lar object may change, and the Active Directory volumes in Windows 2000. Windows 2000 main- maintains the binding between the GUID and tains Discretionary Access Control Lists (DACL) and the SID if necessary. System Access Control Lists (SACL) on files and di- rectories within all NTFS volumes. Without NTFS, One of the main shortcomings of Windows NT 4.0 object security and user accountability are not was its limitation of being capable of holding only possible. Windows 2000 also maintains DACLs 40,000 objects in the SAM database. Active Direc- and SACLs on other system objects, including tory removes that limitation. The Windows 2000 memory constructs, the Active Directory, and the implementation of the ESE can support databases Registry. Section 4 in the next paper in the series up to 16 terabytes in size. Microsoft has tested the will discuss ACLs in Windows 2000. Active Directory with 40 million objects. Active Directory Data Model User Identification - The Active Directory data model is based on the The Active Directory X.500 [4] model.
Load more

Recommended publications
  • Cygwin User's Guide
    Cygwin User’s Guide Cygwin User’s Guide ii Copyright © Cygwin authors Permission is granted to make and distribute verbatim copies of this documentation provided the copyright notice and this per- mission notice are preserved on all copies. Permission is granted to copy and distribute modified versions of this documentation under the conditions for verbatim copying, provided that the entire resulting derived work is distributed under the terms of a permission notice identical to this one. Permission is granted to copy and distribute translations of this documentation into another language, under the above conditions for modified versions, except that this permission notice may be stated in a translation approved by the Free Software Foundation. Cygwin User’s Guide iii Contents 1 Cygwin Overview 1 1.1 What is it? . .1 1.2 Quick Start Guide for those more experienced with Windows . .1 1.3 Quick Start Guide for those more experienced with UNIX . .1 1.4 Are the Cygwin tools free software? . .2 1.5 A brief history of the Cygwin project . .2 1.6 Highlights of Cygwin Functionality . .3 1.6.1 Introduction . .3 1.6.2 Permissions and Security . .3 1.6.3 File Access . .3 1.6.4 Text Mode vs. Binary Mode . .4 1.6.5 ANSI C Library . .4 1.6.6 Process Creation . .5 1.6.6.1 Problems with process creation . .5 1.6.7 Signals . .6 1.6.8 Sockets . .6 1.6.9 Select . .7 1.7 What’s new and what changed in Cygwin . .7 1.7.1 What’s new and what changed in 3.2 .
    [Show full text]
  • Microsoft Windows Common Criteria Evaluation Security Target
    Microsoft Common Criteria Security Target Microsoft Windows Common Criteria Evaluation Microsoft Windows 10 version 1809 (October 2018 Update) Microsoft Windows Server 2019 (October 2018 Update) Security Target Document Information Version Number 0.05 Updated On June 18, 2019 Microsoft © 2019 Page 1 of 126 Microsoft Common Criteria Security Target Version History Version Date Summary of changes 0.01 June 27, 2018 Initial draft 0.02 December 21, 2018 Updates from security target evaluation 0.03 February 21, 2019 Updates from evaluation 0.04 May 6, 2019 Updates from GPOS PP v4.2.1 0.05 June 18, 2019 Public version Microsoft © 2019 Page 2 of 126 Microsoft Common Criteria Security Target This is a preliminary document and may be changed substantially prior to final commercial release of the software described herein. The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. This work is licensed under the Creative Commons Attribution-NoDerivs- NonCommercial License (which allows redistribution of the work). To view a copy of this license, visit http://creativecommons.org/licenses/by-nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA.
    [Show full text]
  • Windows System Error Codes and What They Mean
    Windows system error codes and what they mean This information was gathered from: https://msdn.microsoft.com/en-us/library/windows/desktop/ ms681382(v=vs.85).aspx You can find additional error codes and messages in the above website. Code Description: 0 The operation completed successfully. 1 Incorrect function. 2 The system cannot find the file specified. 3 The system cannot find the path specified. 4 The system cannot open the file. 5 Access is denied. 6 The handle is invalid. 7 The storage control blocks were destroyed. 8 Not enough storage is available to process this command. 9 The storage control block address is invalid. 10 The environment is incorrect. 11 An attempt was made to load a program with an incorrect format. 12 The access code is invalid. 13 The data is invalid. 14 Not enough storage is available to complete this operation. 15 The system cannot find the drive specified. 16 The directory cannot be removed. 17 The system cannot move the file to a different disk drive. 18 There are no more files. 19 The media is write protected. 20 The system cannot find the device specified. 21 The device is not ready. 22 The device does not recognize the command. 23 Data error (cyclic redundancy check). 24 The program issued a command but the command length is incorrect. 25 The drive cannot locate a specific area or track on the disk. 26 The specified disk or diskette cannot be accessed. 27 The drive cannot find the sector requested. 28 The printer is out of paper.
    [Show full text]
  • DRBL-Winroll: the Free Configuration Program for Microsoft Windows
    DRBL-Winroll: The Free configuration program for Microsoft Windows Ceasar Sun, Steven Shiau, Thomas Tsai http://drbl-winroll.org , http://drbl.org , http://clonezilla.org/ RMLL (LSM) 2015 Q3, 2015 1 Outline Introduction to DRBL-Winroll – Develop Team – Common Issues for Windows Replication – Feature/Framework Cases of Usages – Basic Installation and usage – How to do centralize management – Advanced usage Limitation/Development/Contribution Q&A 2 Outline Introduction to DRBL-Winroll – Develop Team – Common Issues for Windows Replication – Feature/Framework Cases of Usages – Basic Installation and usage – How to do centralize management – Advanced usage Limitation/Development/Contribution Q&A 3 About us • From Taiwan, working for the NPO NCHC (National Center for High- Performance Computing) • Developers of free/open-source software: – DRBL, Clonezilla – DRBL-Winroll, Tux2live – Partclone, Tuxboot, Cloudboot – ... more Taiwan image source: wikipedia.org 4 Developers/Contributor • Steven Shiau • Ceasar Sun • Thomas Tsai • Jazz Wang • Jean René Mérou Sánchez • K. L. Huang • Jean-Francois Nifenecker • Louie Chen • Nagappan Alagappan • … 5 Replication Issue 6 Copy & Paste ? • Data v.s Configurations – For small scale replication , it's easy. • Deployment is one thing, but configuration is another – Not only copy-and-paste 7 Configuration with Massive Scale • Not possible by hand , automatical configuration is better I©m Robot #1 Hello, I©m Robot #2 Hello, I©m Robot #3 Hello, I©m Robot #.. 8 Mass Deployment • What is “mass deployment”
    [Show full text]
  • Clustered Data ONTAP® 8.3 File Access Management Guide for NFS
    Updated for 8.3.1 Clustered Data ONTAP® 8.3 File Access Management Guide for NFS NetApp, Inc. Telephone: +1 (408) 822-6000 Part number: 215-10105_A0 495 East Java Drive Fax: +1 (408) 822-4501 June 2015 Sunnyvale, CA 94089 Support telephone: +1 (888) 463-8277 U.S. Web: www.netapp.com Feedback: [email protected] Table of Contents | 3 Contents Considerations before configuring file access .......................................... 10 File protocols that Data ONTAP supports ................................................................. 10 How Data ONTAP controls access to files ................................................................ 10 Authentication-based restrictions .................................................................. 10 File-based restrictions ................................................................................... 11 LIF configuration requirements for file access management .................................... 11 How namespaces and volume junctions affect file access on SVMs with FlexVol volumes ................................................................................................................ 11 What namespaces in SVMs with FlexVol volumes are ................................. 11 Volume junction usage rules ......................................................................... 12 How volume junctions are used in SMB and NFS namespaces .................... 12 What the typical NAS namespace architectures are ...................................... 12 Creating and managing data volumes
    [Show full text]
  • Clustered Data ONTAP 8.3 NFS File Access Reference Guide
    Clustered Data ONTAP® 8.3 NFS File Access Reference Guide February 2016 | 215-10877_A0 [email protected] Updated for 8.3.2 Table of Contents | 3 Contents Deciding whether to use this guide ............................................................. 8 Considerations before configuring file access ............................................ 9 File protocols that Data ONTAP supports ................................................................... 9 How Data ONTAP controls access to files .................................................................. 9 Authentication-based restrictions .................................................................... 9 File-based restrictions ................................................................................... 10 LIF configuration requirements for file access management .................................... 10 How namespaces and volume junctions affect file access on SVMs with FlexVol volumes ................................................................................................................ 10 What namespaces in SVMs with FlexVol volumes are ................................. 10 Volume junction usage rules ......................................................................... 11 How volume junctions are used in SMB and NFS namespaces .................... 11 What the typical NAS namespace architectures are ...................................... 11 Creating and managing data volumes in NAS namespaces ...................................... 14 Creating data volumes
    [Show full text]
  • More Than You Ever Wanted to Know About NT Login Authentication
    A Perspective On Practical Security 2000 More Than You Ever Wanted to Know about NT Login Authentication SystemExperts Corporation Philip C. Cox & Paul B. Hill Abstract Inside The login process is the user's entry-point to the computing • Under the covers for a local NT login environment, the best or perhaps only chance for real • NT & LAN Manager compatibility authentication. No authorization decision has any meaning absent authentication. Taking the rapid adoption of NT as a given, any • Password encryption within the Security Accounts Manager organization must understand exactly how NT login authentication (SAM) database works if it is to determine whether or not NT login can meet the organization's needs. Otherwise, the choices are faith and luck. • User Authentication Process This white paper describes an Interactive NT login and lays the • Use of the LsaLogonUser API groundwork for understanding the Network login. This information is current as of NT 4.0 Service Pack 5. • The groundwork for understanding network login. NT Login Authentication SystemExperts Corporation There are no less than 5 types of “logons” in Windows NT, but only three are commonly used: Interactive, Network, and Service. Boston New York Washington D.C Tampa San Francisco Los Angeles Sacramento 1. Interactive logons are for users logging onto the console and for processes that require “interactive” access. Interactive NT Toll free (USA only): +1 888 749 9800 user authentication itself takes several forms: From outside USA: +1 978 440 9388 - Login with a locally defined user account — no network access is required; the account is authenticated by the machine you are logging into and only by that machine www.systemexperts.com [email protected] Copyright 1997-2001 SystemExperts Corporation.
    [Show full text]
  • Windows Server 2003 Security Guide
    Microsoft Solutions for Security and Compliance Windows Server 2003 Security Guide April 26, 2006 © 2006 Microsoft Corporation. This work is licensed under the Creative Commons Attribution-Non Commercial License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc/2.5/ or send a letter to Creative Commons, 543 Howard Street, 5th Floor, San Francisco, California, 94105, USA. Table of Contents iii Contents Chapter 1: Introduction to the Windows Server 2003 Security Guide ............. 1 Overview....................................................................................................1 Executive Summary .....................................................................................1 Who Should Read This Guide.........................................................................2 Scope of this Guide......................................................................................2 Chapter Summaries .....................................................................................3 Chapter 1: Introduction to the Windows Server 2003 Security Guide .............4 Chapter 2: Windows Server 2003 Hardening Mechanisms ............................4 Chapter 3: The Domain Policy..................................................................4 Chapter 4: The Member Server Baseline Policy ...........................................4 Chapter 5: The Domain Controller Baseline Policy .......................................5 Chapter 6: The Infrastructure Server Role .................................................5
    [Show full text]
  • A Survey of Access Control Policies
    A Survey of Access Control Policies Amanda Crowell University of Maryland [email protected] ABSTRACT nisms to the standard checks. Modern operating systems each have different implementa- tions of access controls and use different policies for deter- The Common Weakness Enumeration (CWE) describes sev- mining the access that subjects may have on objects. This eral mistakes that application developers have made in re- paper reviews the three main types of access control policies: gard to access control. Often, developers do not give the discretionary, mandatory, and role-based. It then describes application objects the appropriate rights to begin with (i.e. how Windows and various Unix systems implement their they specify more rights than are necessary) and do not chosen access control policies. Finally, it discusses some modify rights throughout the application's lifetime. Since common mistakes that application programmers make when spawned processes typically take on the rights of the spawn- enforcing access control in their applications and gives some ing process, rights might be passed on to the spawned pro- general guidance to reduce the occurrence of mistakes. cess that were unintentional. In response to these mistakes, some researchers have developed guidelines for using access 1. INTRODUCTION controls appropriately. These include: (a) understanding Modern operating systems use different mechanisms for pro- what information is available to the system and how it can viding access control. These mechanisms are designed to be used to make decisions, (b) determining exactly which meet security policies that vary in the way access decisions rights are absolutely necessary and only allow those and are made.
    [Show full text]
  • Database Installation Guide
    Oracle® Database Database Installation Guide 19c for Microsoft Windows E96293-06 June 2020 Oracle Database Database Installation Guide, 19c for Microsoft Windows E96293-06 Copyright © 1996, 2020, Oracle and/or its affiliates. Primary Authors: Sunil Surabhi, Tanaya Bhattacharjee Contributing Authors: Prakash Jashnani, Mark Bauer, Bharathi Jayathirtha Contributors: Barb Glover, Eric Belden, Sudip Datta, David Friedman, Alex Keh, Peter LaQuerre, Rich Long, Matt McKerley, Sham Rao Pavan, Hanlin Qian, Sujatha Tolstoy, Sergiusz Wolicki, Sue Mavris, Mohammed Shahnawaz Quadri, Vishal Saxena, Krishna Itikarlapall, , Santanu Datta, Christian Shay, Aneesh Khanderwal, Michael Coulter, Robert Achacoso, Malai Stalin, David Price, Ramesh Chakravarthula This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs (including any operating system, integrated software, any programs embedded, installed or activated on delivered hardware, and modifications of such programs) and Oracle computer documentation or other Oracle data delivered to or accessed by U.S.
    [Show full text]
  • Mcgraw.Hill.Hacknotes.Windows.Security.Portable
    HackNote / HackNotes Windows Security Portable Reference / O’Dea / 222785-0 / Color profile: Generic CMYK printer profile Composite Default screen blind folio i HACKNOTES™ “HackNotes Windows Security Portable Reference distills into a small form factor the encyclopedic information in the original Hacking Exposed: Windows 2000.” —Joel Scambray, coauthor of Hacking Exposed 4th Edition, Hacking Exposed Windows 2000, and Hacking Exposed Web Applications; Senior Director of Security, Microsoft’s MSN “HackNotes Windows Security Portable Reference takes a ‘Just the Facts, Ma’am’ approach to securing your Windows infrastructure. It checks the overly long exposition at the door, focusing on specific areas of attack and defense. If you’re more concerned with securing systems than speed-reading thousand-page tech manuals, stash this one in your laptop case now.” —Chip Andrews, www.sqlsecurity.com, Black Hat Speaker, and coauthor of SQL Server Security “No plan, no matter how well-conceived, survives contact with the enemy. That’s why Michael O’Dea’s HackNotes Windows Security Portable Reference is a must-have for today’s over-burdened, always-on-the-move security professional. Keep this one in your hip pocket. It will help you prevent your enemies from gaining the initiative.” —Dan Verton, author of Black Ice: The Invisible Threat of Cyber-Terrorism and award-winning senior writer for Computerworld “HackNotes Windows Security Portable Reference covers very interesting and pertinent topics, especially ones such as common ports and services, NetBIOS name table definitions, and other very specific areas that are essential to understand if one is to genuinely comprehend how Windows systems are attacked.
    [Show full text]
  • Lustre Windows Client High Level Design Sun Microsystems
    Lustre Windows Client High Level Design Sun Microsystems April 8, 2008 Developed by: OSR Open Systems Resources, Inc. 105 Route 101A, Suite 19 Amherst, New Hampshire 03031-2277 (603) 595-6500 (603) 595-6503 © 2008 OSR Open Systems Resources, Inc. All rights reserved. No part of this work covered by the copyright hereon may be reproduced or used in any form or by any means -- graphic, electronic, or mechanical, including photocopying, recording, taping, or information storage and retrieval systems -- without written permission of OSR Open Systems Resources, Inc., 105 Route 101A Suite 19, Amherst, New Hampshire 03031, (603) 595-6500 OSR, the traditional OSR Logo, the new OSR logo, “OSR Open Systems Resources, Inc.”, and “The NT Insider” are trademarks of OSR Open Systems Resources, Inc. All other trademarks mentioned herein are the property of their owners. Printed in the United States of America Document Identifier: PR088-02 LIMITED WARRANTY OSR Open Systems Resources, Inc. (OSR) expressly disclaims any warranty for the information presented herein. This material is presented “as is” without warranty of any kind, either express or implied, including, without limitation, the implied warranties of merchantability or fitness for a particular purpose. The entire risk arising from the use of this material remains with you. OSR’s entire liability and your exclusive remedy shall not exceed the price paid for this material. In no event shall OSR or its suppliers be liable for any damages whatsoever (including, without limitation, damages for loss of business profit, business interruption, loss of business information, or any other pecuniary loss) arising out of the use or inability to use this information, even if OSR has been advised of the possibility of such damages.
    [Show full text]