- 1 More Vulnerabilities for Microsoft
- 2 More Vulnerabilities for Microsoft
- 3 More Vulnerabilities for Microsoft
- 4 Windows Worm, Multiple Bugs Haunt MS Users
- 5 Windows Worm, Multiple Bugs Haunt MS Users
- 6 Windows Worm, Multiple Bugs Haunt MS Users
- 7 Top 10 Enterprise Security Risks
- 8 Users Urge Disclosure of Security Flaws
- 9 MS Issues Patch to Plug WMP Holes
- 10 MS Warns of Commerce Server Flaw
- 11 MS Warns of Commerce Server Flaw
- 12 Serious OpenSSH Flaw Detected
- 13 Serious OpenSSH Flaw Detected
- 14 Older Windows Versions Left Out Of Code Cleanup
- 15 Older Windows Versions Left Out Of Code Cleanup
- 16 Older Windows Versions Left Out Of Code Cleanup
- 17 Microsoft's Move To Mothball Old Code Raises Concerns
CERT Warns of Multiple SQL Flaws
Digg
DZone
Reddit
Slashdot
StumbleUpon
del.icio.us
Facebook
FriendFeed
Furl
A CERT advisory issued Monday evening warns of several vulnerabilities in Microsoft SQL Server.
Microsoft SQL Server 7.0, Microsoft SQL Server 2000, and Microsoft SQL Server Desktop Engine 2000 are affected. A CERT advisory issued Monday evening warns of several vulnerabilities in Microsoft SQL Server.
CERT Advisory CA-2002-22 warns of several serious vulnerabilities in Microsoft SQL Server that enable remote attackers to obtain sensitive information, alter database content, compromise SQL servers, and, in some configurations, compromise server hosts.
Individually, these vulnerabilities have significant preconditions that are difficult for an attacker to overcome. However, if exploited in combination, they would allow an attacker to gain additional flexibility and increase his or her chances for success.
The following vulnerabilities are highlighted in the advisory:
- VU#796313: Microsoft SQL Server service account registry key has weak permissions that permit escalation of privileges (CAN-2002-0642)
- VU#225555: Microsoft SQL Server contains buffer overflow in pwdencrypt() function (CAN-2002-0624)
- VU#399260: Microsoft SQL Server 2000 contains heap buffer overflow in SQL Server Resolution Service (CAN-2002-0649)
- VU#484891: Microsoft SQL Server 2000 contains stack buffer overflow in SQL Server Resolution Service (CAN-2002-0649)
- VU#399260: Microsoft SQL Server 2000 contains heap buffer overflow in SQL Server Resolution Service
Although Microsoft has gone public about the vulnerabilities and already addressed the situation by releasing the Security Bulletins, CERT believes their collective severity warrants additional attention. Hence, the advisory.
Since December 2001, Microsoft has published eight Microsoft Security Bulletins for more than a dozen vulnerabilities in the Microsoft SQL Server.
The full advisory is online on CERT's site at http://www.cert.org/advisories/CA-2002-22.html.
