Flaw Threatens SQL Server

Microsoft Corp. has issued a patch for a buffer overrun vulnerability in some versions of its SQL Server database software that could enable an attacker to execute code on a vulnerable machine.

The flaw, which affects SQL Server 7.0 and 2000, occurs when extended stored procedures validate input to the database. The procedures are external routines that in SQL are used for some helper functions.

Several of these procedures dont perform the input validation process correctly, leaving the server open to a buffer overrun, according Microsofts advisory on the problem, released late Wednesday. A successful exploit of this flaw could either cause SQL to fail or allow the attacker to run arbitrary code on the machine.

There are two possible exploit scenarios, Microsoft said. The first would require the attacker to load and execute a database query on a vulnerable server that calls one of the affected functions. In the second scenario, if the databases front end were configured to process arbitrary queries, an attacker could provide inputs that would cause the query to call an affected function.

However, any code the attacker executes on a vulnerable machine would only run in the security context of the SQL Server software, which by default runs as a domain user.