News

Microsoft Issues 3 Patches, 1 Fixes Critical SQL Flaw

• By Scott Bekker
• 10/17/2002

The flurry of security bulletins takes Microsoft to 61 bulletins so far in 2002, one more than the software giant issued for all of 2001. However, Microsoft is not close to issuing as many bulletins as it did in 2000, when the company put out 100 alerts.

The SQL Server flaw rates a "critical" designation on Microsoft's threat scale because it carries the possibility of an attacker elevating his privileges on a system. Both SQL Server 7.0 and SQL Server 2000 are vulnerable. To exploit the flaw, an attacker must be able to authenticate to the SQL Server and the server has to use a feature known as Web tasks.

More information on the vulnerability is available here.

Security Bulletin MS02-061 is the second major security bulletin for SQL Server this month and the fourth in the last four months.

Microsoft posted a patch for Windows XP Help and Support Center on Wednesday for a vulnerability that could allow an attacker to delete files on a user's system. The vulnerability is of the class that requires a user to open an HTML mail from an attacker or visit the attacker's Web site to exploit. More information on the vulnerability can be found here.

In another case of a seldom-used, whiz-bang feature turning out to be a vulnerability, Microsoft posted a bulletin for a problem with Word fields and Excel external updates. Both allow data from one document to be inserted to another document. Such features are a staple of Microsoft demos, where back-end databases constantly feed the latest corporate data into end user documents.

Turns out attackers can use the normally hidden fields to steal files from a user without the user's knowledge. The attacker would have to know the exact filename and entice the user to open the document, save it and return it to the attacker. Such an attack would leave an audit trail, if the victim ever became aware of it.

More information on the vulnerability can be found here.