Reported October 2, 2002, by Microsoft.

VERSIONS AFFECTED

 

·         Microsoft SQL Server 2000

·         Microsoft SQL Server 7.0

·         Microsoft SQL Server Desktop Engine 2000

·         Microsoft Data Engine 1.0

 

 

DESCRIPTION

 

Three new vulnerabilities exist in SQL Server, Microsoft SQL Server Desktop Engine 2000, and Microsoft Data Engine 1.0, the most serious of which could let an attacker execute arbitrary code on the vulnerable system. These vulnerabilities are

 

·         a buffer overrun in a section of code in SQL Server 2000 and Microsoft SQL Server Desktop Engine 2000 associated with user authentication—By sending a specially malformed logon request to an affected server, an attacker can either cause the server to fail or gain the ability to overwrite the server's memory and potentially run code on the server in the SQL Server service's security context. This vulnerability doesn't require the attacker to successfully authenticate to the server or to be able to issue direct commands to the server.

 

·         a buffer overrun vulnerability that occurs in one of the Database Console Commands that ship as part of SQL Server 2000 and 7.0—By exploiting this vulnerability, an attacker can run code in the SQL Server service's security context.

 

·         a vulnerability associated with SQL Server 2000 and 7.0 scheduled jobs—By default, SQL Server lets unprivileged users create scheduled jobs that the SQL Server Agent executes. A vulnerability stems from the fact that when a job step requests that an output file be created, the SQL Server Agent does so using its own privileges rather than the job owner's privileges. As a result, an unprivileged user can submit a job that either creates a file containing valid OS commands in another user’s Startup folder or overwrites system files to disrupt system operations.

 

VENDOR RESPONSE

 

The vendor, Microsoft, has released Security Bulletin MS02-056 (Cumulative Patch for SQL Server) to address these vulnerabilities and recommends that affected users immediately apply the appropriate patch mentioned in the bulletin. The patch changes the operation of SQL Server to prevent nonadministrative users from running ad hoc queries against non-SQL OLE DB data sources. This new operation helps prevent misuse of poorly coded data providers that might be installed on the server.

CREDIT

Discovered by sk@scan-associates.net, pokleyzz@scan-associates.net and Martin Rakhmanoff.