Reported October 2, 2002, by
Microsoft.
VERSIONS AFFECTED
·
Microsoft SQL Server 2000
·
Microsoft SQL Server 7.0
·
Microsoft SQL Server Desktop Engine 2000
·
Microsoft Data Engine 1.0
DESCRIPTION
Three new vulnerabilities exist in SQL Server, Microsoft
SQL Server Desktop Engine 2000, and Microsoft Data Engine 1.0, the most serious
of which could let an attacker execute arbitrary code on the vulnerable system.
These vulnerabilities are
·
a buffer overrun in a section of code in SQL Server 2000
and Microsoft SQL Server Desktop Engine 2000 associated with user
authentication—By sending a specially malformed logon request to an affected
server, an attacker can either cause the server to fail or gain the ability to
overwrite the server's memory and potentially run code on the server in the SQL
Server service's security context. This vulnerability doesn't require the
attacker to successfully authenticate to the server or to be able to issue
direct commands to the server.
·
a buffer overrun vulnerability that occurs in one of the
Database Console Commands that ship as part of SQL Server 2000 and 7.0—By
exploiting this vulnerability, an attacker can run code in the SQL Server
service's security context.
·
a vulnerability associated with SQL Server 2000 and 7.0
scheduled jobs—By default, SQL Server lets unprivileged users create scheduled
jobs that the SQL Server Agent executes. A vulnerability stems from the fact
that when a job step requests that an output file be created, the SQL Server
Agent does so using its own privileges rather than the job owner's privileges.
As a result, an unprivileged user can submit a job that either creates a file
containing valid OS commands in another user’s Startup folder or overwrites
system files to disrupt system operations.
VENDOR RESPONSE
The vendor, Microsoft,
has released Security Bulletin MS02-056
(Cumulative Patch for SQL Server) to address these vulnerabilities and
recommends that affected users immediately apply the appropriate patch mentioned
in the bulletin. The patch changes the operation of SQL Server to
prevent nonadministrative users from running ad hoc queries against non-SQL OLE
DB data sources. This new operation helps prevent misuse of poorly coded data
providers that might be installed on the server.
CREDIT
Discovered by sk@scan-associates.net,
pokleyzz@scan-associates.net
and Martin Rakhmanoff.
End of Article
