Security pros groan as zero-day hits Microsoft's SQL Server
Meanwhile, IE 7 attacks on the rise
Customer Success Testimonial: Recovery is Everything
Yet another zero-day vulnerability has been identified in a popular Microsoft product, this time in its SQL Server database. The revelation comes as miscreants are stepping up attacks on a particularly nasty bug in the latest version of Internet Explorer.
The SQL Server bug could allow the remote execution of malicious code, according to researchers at Austria-based SEC Consult. The company said attackers exploiting the flaw would have to be authenticated users on the system, a requirement that a Microsoft spokesman also said minimizes the risk. But an SEC Consult advisory warned it's still possible for outsiders to target the vulnerability remotely on websites that link search boxes, customer data bases or other web apps to SQL Server.
"The vulnerability can be exploited by an authenticated user with a direct database connection, or via SQL injection in a vulnerable web application," the advisory said. "The vulnerability has been successfully used to execute arbitrary code on a lab machine."
SEC Consult has confirmed the flaw in the 2000 and 2005 versions of SQL Server. It has not yet tested version 2008. It triggers the rewriting of a computer's memory by supplying several uninitialized variables to the sp_replwritetovarbin stored procedure. Microsoft was alerted to the bug in April, according to SEC Consult.
There are no reports of the bug being attacked in the wild, a Microsoft spokesman said.
It's shaping up as quite a week for security professionals. Combined with bugs in IE 7 and the WordPad text converter for Word 97, the world now has three Microsoft zero-day vulnerabilities on its hands. And they come on the heels of Tuesday's release of fixes for 28 vulnerabilities, the biggest patch batch in five years.
"We're running at full speed right just to keep up with all that," said Rick Howard, intelligence director for iDefense, a security lab owned by VeriSign. "Twenty-eight is a lot, so while everybody is working to patch those things, a zero-day is sort of floating out there and not getting all the attention it would have gotten if it came out out of cycle."
So far, reports indicate that relatively few attacks are targeting the IE flaw, but now that attack code has been publicly released, Howard expects that to change.
Mary Landesman, a researcher at ScanSafe, a company that provides malware scanning services for large companies, seconds that prediction and said she's already seeing an increase. In just the past few days, she said, ScanSafe has observed four times as many attacks targeting the IE 7 flaw than attacks resulting from the widely reported Koobface worm.
What's more, the IE vulnerability is particularly pernicious. It has the ability to completely hijack a machine simply by visiting the wrong site. According to Howard, attackers are catching victims off-guard by compromising legitimate websites and then inserting an iframe that causes those using IE 7 to be hit.
The best way to protect yourself against the IE attack is to stop using the browser until it's been patched. For those who simply must use it, Microsoft has a list of recommendations that can be accessed by going here and expanding the workarounds section. ®
COMMENTS
a simple question ..
OK, a bug in the sp_replwritetovarbin stored procedure can lead to someone, over the web, compromising a database by entering code instead of data into a search box. The code being injected through the use of 'uninitialized variables'.
This is possible because of the way processes interact on the Operating System. My question is a simple one: Is it possible for the worlds chief software architects to design a system that doesn't fallover because someone forgot to test for some un-initialised variables ?
@Thom Brown
Actually I was thinking more like when a fireman orders everyone out of the building because it's a lost cause, there's no neighboring properties, the building is abandoned anyway, and it's been the site of multiple previous arson fires.
definition of a zero-day exploit ..
"Huh? If the bug was known about in April, how on earth does it qualify as a zero-day sploit?", Frumious Bandersnatch
Because there is as yet, no known patch and exploits have been available since Nov 15, that's a window of at lest seven months, and they didn't tell the rest of us until the inadventent publication of exploit code after the last patch-tuesday failed to address the bug.
http://www.theregister.co.uk/2008/12/11/ie7_exploit_leak/
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
