Sunday, May 9, 2021

CERT Warns of Multiple SQL Flaws

A CERT advisory issued Monday evening warns of several vulnerabilities in Microsoft SQL Server.

Microsoft SQL Server 7.0, Microsoft SQL Server 2000, and Microsoft SQL Server Desktop Engine 2000 are affected.

CERT Advisory CA-2002-22 warns of several serious vulnerabilities in Microsoft SQL Server that enable remote attackers to obtain sensitive information, alter database content, compromise SQL servers, and, in some configurations, compromise server hosts.

Individually, these vulnerabilities have significant preconditions that are difficult for an attacker to overcome. However, if exploited in combination, they would allow an attacker to gain additional flexibility and increase his or her chances for success.

The following vulnerabilities are highlighted in the advisory:

  • VU#796313: Microsoft SQL Server service account registry key has weak permissions that permit escalation of privileges (CAN-2002-0642)
  • VU#225555: Microsoft SQL Server contains buffer overflow in pwdencrypt() function (CAN-2002-0624)
  • VU#399260: Microsoft SQL Server 2000 contains heap buffer overflow in SQL Server Resolution Service (CAN-2002-0649)
  • VU#484891: Microsoft SQL Server 2000 contains stack buffer overflow inSQL Server Resolution Service (CAN-2002-0649)
  • VU#399260: Microsoft SQL Server 2000 contains heap buffer overflow in SQL Server Resolution Service

Microsoft has published Security Bulletin MS02-034 to addresses VU#796313 and VU#225555, Security Bulletin MS02-020 to address VU#627275, and Security Bulletin MS02-039 to address VU#399260 and VU#484891.

Although Microsoft has gone public about the vulnerabilities and already addressed the situation by releasing the Security Bulletins, CERT believes their collective severity warrants additional attention. Hence, the advisory.

Since December 2001, Microsoft has published eight Microsoft Security Bulletins for more than a dozen vulnerabilities in the Microsoft SQL Server.

The full advisory is online on CERT’s site at http://www.cert.org/advisories/CA-2002-22.html.

Similar articles

Latest Articles

Top 10 Professional Services...

These are some of the best PSA tools for organizations of all sizes. What Is Professional Services Automation Software? Professional services automation (PSA) software aims to...

What is Data Aggregation?

Data aggregation is the process where raw data is gathered and presented in a summarized format for statistical analysis. The data may be gathered...

Dell APEX: Our...

One of the missteps IBM made last century was collapsing their sales model, which was services based, to generate a short-term revenue spike. Up...

Companies that Scaled Technology...

NEW YORK — Companies that “doubled down” on their investment in mostly data-heavy technology during the COVID-19 pandemic have seen their revenue grow five...