Microsoft plugs privilege elevation flaw in SQL server

Microsoft has said that its SQL Server 7.0 and 2000 software both contain a critical flaw that allows low-privilege users to...

Microsoft has said that its SQL Server 7.0 and 2000 software both contain a critical flaw that allows low-privilege users to elevate their privilege level and make changes to tasks created by other users.

The two SQL Server versions provide "stored procedures", collections of Transact-SQL statements that are stored under one name and processed as a group. These are normally used for managing SQL Server and for displaying information about databases and users.

One of these stored procedures lets users run, delete, insert or update Web tasks. Web tasks let a Web developer create an Active Server Page (ASP) that sends a request to the SQL Server for an HTTP file containing the data it needs.

Normally, only administrators and database operators should be able to do this but currently lower-privilege users can do so.

An attacker, if able to authenticate to the server as a low-privilege user, could take advantage of this to delete, insert or change the Web tasks created by other users. The attacker could also run pre-created tasks in the context of the creator of those tasks.

The attacker would need to be an authenticated user of the system and could only change or run existing Web tasks, not create new ones, Microsoft said.

A patch for the current flaw is available at: www.microsoft.com/technet/security/bulletin/ms02-061.asp

The latest patch is in addition to a cumulative patch issued in early October for several flaws in SQL Server 7.0 and 2000.

Read more on Business applications

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.

-ADS BY GOOGLE

SearchCIO

SearchSecurity

SearchNetworking

SearchDataCenter

SearchDataManagement

Close