[ISN] Microsoft plugs privilege elevation flaw in SQL Server

From: InfoSec News (isnat_private)
Date: Thu Oct 17 2002 - 22:49:41 PDT

  • Next message: InfoSec News: "[ISN] Backdoor LAN"

    By Gillian Law, IDG News Service
    OCTOBER 17, 2002
    Microsoft Corp.'s SQL Server 7.0 and 2000 software both contain a
    critical flaw that would allow low-privilege users to elevate their
    privilege level and make changes to tasks created by other users, the
    company said yesterday.
    The two SQL Server versions provide "stored procedures," collections
    of Transact-SQL statements that are stored under one name and
    processed as a group, Microsoft said. These are normally used for
    managing SQL Server and for displaying information about databases and
    One of these stored procedures lets users run, delete, insert or
    update Web tasks. Web tasks let a Web developer create an Active
    Server Page that sends a request to the SQL Server for an HTTP file
    containing the data it needs.
    Normally, only administrators and database operators should be able to
    do this, but currently lower-privilege users can do so.
    An attacker, if able to authenticate to the server as a low-privilege
    user, could take advantage of this to delete, insert or change the Web
    tasks created by other users. The attacker could also run previously
    created tasks in the context of the creator of those tasks.
    The attacker would need to be an authenticated user of the system and
    could change or run only existing Web tasks, not create new ones,
    Microsoft said.
    A patch for the flaw is posted on Microsoft's TechNet Web site.
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.

    This archive was generated by hypermail 2b30 : Fri Oct 18 2002 - 01:38:33 PDT