Microsoft SQL Server 7.0, Microsoft SQL Server 2000, and Microsoft SQL Server Desktop Engine 2000 are affected.
CERT Advisory CA-2002-22 warns of several serious vulnerabilities in Microsoft SQL Server that enable remote attackers to obtain sensitive information, alter database content, compromise SQL servers, and, in some configurations, compromise server hosts.
Individually, these vulnerabilities have significant preconditions that are difficult for an attacker to overcome. However, if exploited in combination, they would allow an attacker to gain additional flexibility and increase his or her chances for success.
The following vulnerabilities are highlighted in the advisory:
Although Microsoft has gone public about the vulnerabilities and already addressed the situation by releasing the Security Bulletins, CERT believes their collective severity warrants additional attention. Hence, the advisory.
Since December 2001, Microsoft has published eight Microsoft Security Bulletins for more than a dozen vulnerabilities in the Microsoft SQL Server.
The full advisory is online on CERT's site at http://www.cert.org/advisories/CA-2002-22.html.