Description: Cumulative patch now available from Microsoft that will fix three new security vulnerabilities and most previous ones.
| Number: | 600-00052 | | Category: | Database - SQL 7 | | Product: | Enterprise Address Book | | Created: | 7/31/2002 | | Last Modified: |
4/08/2004 |
Issue/Symptom: July 23, 2003, Microsoft released a security bulletin announcing a cumulative patch for SQL Server 7, fixing three new security vulnerabilities and most previous ones. The vulnerabilities include a local elevation of privilege flaw, a Denial of Server vulnerability, and a buffer overflow. A local hacker could exploit the worst of these flaws to execute malicious code on your SQL Server and gain full control of your SQL database. There is no direct impact on KI Systems products. SQL Server 7 administrators should download, test and apply the cumulative patch during their next maintenance cycle. Microsoft's security bulletin describes the latest SQL Server 7 cumulative patch, fixing previously known security vulnerabilities plus these three new ones: A local Elevation of Privilege flaw in SQL Server allows an attacker who is able to locally log into the SQL server (either physically or via Terminal Services) to hijack the session of a user connecting to make SQL queries, and gain that user's privileges. Since an attacker has to log directly onto your SQL server to exploit this flaw, this local attack is not remotely exploitable. Our assessment: if a malicious employee has enough access to log directly onto your SQL server, you already have plenty to worry about before considering this security hole. A Denial of Service (DOS) flaw found in SQL Server allows attackers on the local intranet to crash your SQL server, preventing it from processing new SQL queries until you reboot it. According to Microsoft, the attacker needs access to a trusted domain on your local intranet (though not necessarily the same domain the SQL server is on) to exploit this flaw. Thus, this is another "insider only" risk. A locally exploitable buffer overflow in SQL Server allows an inside attacker to execute code on your SQL Server with the SQL service's privileges. This gives the attacker full control of your SQL database, and in some cases, total control of the server itself. However, like the Elevation of Privilege flaw cited above, the attacker could only exploit this vulnerability while logged directly onto your SQL Server. Most SQL Server vulnerabilities also affect Microsoft Data Engine (MSDE), and these new flaws are no exception. Both MSDE 1.0 and 2000 are also affected by these flaws. For further information and/or to download the SQL Server 7 cumulative patch please see: Microsoft SQL Server 7.0 and MSDE 1,0
DISCLAIMER THE INFORMATION CONTAINED IN THIS DOCUMENT IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. KI SYSTEMS, INC. DISCLAIMS ALL WARRANTIES, EITHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF THIRD-PARTY RIGHTS. THIS INFORMATION IS BEING PROVIDED TO YOU FREE OF CHARGE AND IN NO EVENT SHALL KI SYSTEMS, INC. BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT AND INCIDENTAL, CONSEQUENTIAL, EXEMPLARY AND SPECIAL DAMAGES INCLUDING BUT NOT LIMITED TO LOSS OF BUSINESS PROFITS OR DAMAGES FROM LOST DATA, EVEN IF KI SYSTEMS, INC. HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY TO YOU. | 
