Microsoft plugs privilege elevation flaw in SQL server

Microsoft Corp.’s SQL Server 7.0 and 2000 software both contain a critical flaw that allows low privilege users to elevate their privilege level and make changes to tasks created by other users, the company said Wednesday.

The two SQL Server versions provide “stored procedures,” collections of Transact-SQL statements that are stored under one name and processed as a group, Microsoft said. These are normally used for managing SQL Server, and for displaying information about databases and users.

One of these stored procedures lets users run, delete, insert or update Web tasks. Web tasks let a Web developer create an Active Server Page (ASP) that sends a request to the SQL Server for an HTTP file containing the data it needs.

Normally, only administrators and database operators should be able to do this, but currently lower-privilege users can do so.

An attacker, if able to authenticate to the server as a low-privilege user, could take advantage of this to delete, insert or change the Web tasks created by other users. The attacker could also run pre-created tasks, in the context of the creator of those tasks.

The attacker would need to be an authenticated user of the system, and could only change or run existing Web tasks, not create new ones, Microsoft said.

A patch for the current flaw is available at: http://www.microsoft.com/technet/security/bulletin/ms02-061.asp.

The current patch is in addition to a cumulative patch issued in early October for several flaws in SQL Server 7.0 and 2000.

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now