Microsoft plugs privilege elevation flaw in SQL server

Microsoft's SQL Server 7.0 and 2000 software both contain a critical flaw that allows low privilege users to elevate their privilege level and make changes to tasks created by other users, the company said Wednesday.

The two SQL Server versions provide "stored procedures," collections of Transact-SQL statements that are stored under one name and processed as a group, Microsoft said. These are normally used for managing SQL Server, and for displaying information about databases and users.

One of these stored procedures lets users run, delete, insert or update Web tasks. Web tasks let a Web developer create an Active Server Page (ASP) that sends a request to the SQL Server for an HTTP file containing the data it needs.

Normally, only administrators and database operators should be able to do this, but currently lower-privilege users can do so.

An attacker, if able to authenticate to the server as a low-privilege user, could take advantage of this to delete, insert or change the Web tasks created by other users. The attacker could also run pre-created tasks, in the context of the creator of those tasks.

The attacker would need to be an authenticated user of the system, and could only change or run existing Web tasks, not create new ones, Microsoft said.

A patch for the current flaw is available here.

The current patch is in addition to a cumulative patch issued in early October for several flaws in SQL Server 7.0 and 2000.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gillian Law

Computerworld
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?