Microsoft plugs privilege elevation flaw in SQL server

Microsoft's SQL Server 7.0 and 2000 software both contain a critical flaw that allows low privilege users to elevate their privilege level and make changes to tasks created by other users, the company said Wednesday.

The two SQL Server versions provide "stored procedures," collections of Transact-SQL statements that are stored under one name and processed as a group, Microsoft said. These are normally used for managing SQL Server, and for displaying information about databases and users.

One of these stored procedures lets users run, delete, insert or update Web tasks. Web tasks let a Web developer create an Active Server Page (ASP) that sends a request to the SQL Server for an HTTP file containing the data it needs.

Normally, only administrators and database operators should be able to do this, but currently lower-privilege users can do so.

An attacker, if able to authenticate to the server as a low-privilege user, could take advantage of this to delete, insert or change the Web tasks created by other users. The attacker could also run pre-created tasks, in the context of the creator of those tasks.

The attacker would need to be an authenticated user of the system, and could only change or run existing Web tasks, not create new ones, Microsoft said.

A patch for the current flaw is available here.

The current patch is in addition to a cumulative patch issued in early October for several flaws in SQL Server 7.0 and 2000.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gillian Law

Show Comments





Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?