Feeds

Security pros groan as zero-day hits Microsoft's SQL Server

Meanwhile, IE 7 attacks on the rise

Secure remote control for conventional and virtual desktops

Yet another zero-day vulnerability has been identified in a popular Microsoft product, this time in its SQL Server database. The revelation comes as miscreants are stepping up attacks on a particularly nasty bug in the latest version of Internet Explorer.

The SQL Server bug could allow the remote execution of malicious code, according to researchers at Austria-based SEC Consult. The company said attackers exploiting the flaw would have to be authenticated users on the system, a requirement that a Microsoft spokesman also said minimizes the risk. But an SEC Consult advisory warned it's still possible for outsiders to target the vulnerability remotely on websites that link search boxes, customer data bases or other web apps to SQL Server.

"The vulnerability can be exploited by an authenticated user with a direct database connection, or via SQL injection in a vulnerable web application," the advisory said. "The vulnerability has been successfully used to execute arbitrary code on a lab machine."

SEC Consult has confirmed the flaw in the 2000 and 2005 versions of SQL Server. It has not yet tested version 2008. It triggers the rewriting of a computer's memory by supplying several uninitialized variables to the sp_replwritetovarbin stored procedure. Microsoft was alerted to the bug in April, according to SEC Consult.

There are no reports of the bug being attacked in the wild, a Microsoft spokesman said.

It's shaping up as quite a week for security professionals. Combined with bugs in IE 7 and the WordPad text converter for Word 97, the world now has three Microsoft zero-day vulnerabilities on its hands. And they come on the heels of Tuesday's release of fixes for 28 vulnerabilities, the biggest patch batch in five years.

"We're running at full speed right just to keep up with all that," said Rick Howard, intelligence director for iDefense, a security lab owned by VeriSign. "Twenty-eight is a lot, so while everybody is working to patch those things, a zero-day is sort of floating out there and not getting all the attention it would have gotten if it came out out of cycle."

So far, reports indicate that relatively few attacks are targeting the IE flaw, but now that attack code has been publicly released, Howard expects that to change.

Mary Landesman, a researcher at ScanSafe, a company that provides malware scanning services for large companies, seconds that prediction and said she's already seeing an increase. In just the past few days, she said, ScanSafe has observed four times as many attacks targeting the IE 7 flaw than attacks resulting from the widely reported Koobface worm.

What's more, the IE vulnerability is particularly pernicious. It has the ability to completely hijack a machine simply by visiting the wrong site. According to Howard, attackers are catching victims off-guard by compromising legitimate websites and then inserting an iframe that causes those using IE 7 to be hit.

The best way to protect yourself against the IE attack is to stop using the browser until it's been patched. For those who simply must use it, Microsoft has a list of recommendations that can be accessed by going here and expanding the workarounds section. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.