Microsoft acknowledges a long-standing SQL Server flaw
Tuesday, December 23. 2008
It wouldn't be the Christmas season without the tinsel, the holly, and the zero-days. Since early this month, an exploitable buffer overflow has been known to exist in SQL Server, and today Microsoft is acknowledging its existence.
In a security bulletin released yesterday, Microsoft is saying a somewhat simply exploitable vulnerability exists in all presently used versions of SQL Server dating back to SS 2000 Service Pack 4. It has to do with a Transactional-SQL (T-SQL) statement which apparently uses a parameter that isn't checked for type.
BetaNews has seen the code for a publicly available exploit based on information uncovered by security engineer Bernhard Mueller, who contributed information to two of the incidents covered by Microsoft's last Patch Tuesday round. Mueller is the good guy in this story; unfortunately, malicious users with no ingenuity of their own rely on news from Mueller and others for their inspiration.
Bookmark with:
Continue reading "Microsoft acknowledges a long-standing SQL Server flaw"
