Microsoft plugs privilege elevation flaw in SQL server

Microsoft’s SQL Server 7.0 and 2000 software contain a critical flaw that allows low privilege users to elevate their privilege level and make changes to tasks created by other users, the company said Wednesday.

The two SQL Server versions provide “stored procedures,” collections of Transact-SQL statements that are stored under one name and processed as a group, Microsoft said. These are normally used for managing SQL Server, and for displaying information about databases and users.

One of these stored procedures lets users run, delete, insert or update Web tasks. Web tasks let a Web developer create an Active Server Page (ASP) that sends a request to the SQL Server for an HTTP file containing the data it needs.

Normally, only administrators and database operators should be able to do this, but currently lower-privilege users can do so.

An attacker, if able to authenticate to the server as a low-privilege user, could take advantage of this to delete, insert or change the Web tasks created by other users. The attacker could also run precreated tasks, in the context of the creator of those tasks.

The attacker would need to be an authenticated user of the system, and could only change or run existing Web tasks, not create new ones, Microsoft said.

A patch for the current flaw is available here.

The current patch is in addition to a cumulative patch issued in early October for several flaws in SQL Server 7.0 and 2000.