CERT Warns of Multiple SQL Flaws

A CERT advisory issued Monday evening warns of several vulnerabilities in Microsoft SQL Server.

A CERT advisory issued Monday evening warns of several vulnerabilities in Microsoft SQL Server.

Microsoft SQL Server 7.0, Microsoft SQL Server 2000, and Microsoft SQL Server Desktop Engine 2000 are affected.

CERT Advisory CA-2002-22warns of several serious vulnerabilities in Microsoft SQL Server that enable remote attackers to obtain sensitive information, alter database content, compromise SQL servers, and, in some configurations, compromise server hosts.

Individually, these vulnerabilities have significant preconditions that are difficult for an attacker to overcome. However, if exploited in combination, they would allow an attacker to gain additional flexibility and increase his or her chances for success.

The following vulnerabilities are highlighted in the advisory:

• VU#796313: Microsoft SQL Server service account registry key has weak permissions that permit escalation of privileges (CAN-2002-0642)
• VU#225555: Microsoft SQL Server contains buffer overflow in pwdencrypt() function (CAN-2002-0624)
• VU#399260: Microsoft SQL Server 2000 contains heap buffer overflow in SQL Server Resolution Service (CAN-2002-0649)
• VU#484891: Microsoft SQL Server 2000 contains stack buffer overflow in SQL Server Resolution Service (CAN-2002-0649)
• VU#399260: Microsoft SQL Server 2000 contains heap buffer overflow in SQL Server Resolution Service

Microsoft has published Security Bulletin MS02-034 to addresses VU#796313 and VU#225555, Security Bulletin MS02-020 to address VU#627275, and Security Bulletin MS02-039to address VU#399260 and VU#484891.

Although Microsoft has gone public about the vulnerabilities and already addressed the situation by releasing the Security Bulletins, CERT believes their collective severity warrants additional attention. Hence, the advisory.

Since December 2001, Microsoft has published eight Microsoft Security Bulletins for more than a dozen vulnerabilities in the Microsoft SQL Server.

The full advisory is online on CERT’s site at http://www.cert.org/advisories/CA-2002-22.html.