Feeds

Security pros groan as zero-day hits Microsoft's SQL Server

Meanwhile, IE 7 attacks on the rise

Build a business case: developing custom apps

Yet another zero-day vulnerability has been identified in a popular Microsoft product, this time in its SQL Server database. The revelation comes as miscreants are stepping up attacks on a particularly nasty bug in the latest version of Internet Explorer.

The SQL Server bug could allow the remote execution of malicious code, according to researchers at Austria-based SEC Consult. The company said attackers exploiting the flaw would have to be authenticated users on the system, a requirement that a Microsoft spokesman also said minimizes the risk. But an SEC Consult advisory warned it's still possible for outsiders to target the vulnerability remotely on websites that link search boxes, customer data bases or other web apps to SQL Server.

"The vulnerability can be exploited by an authenticated user with a direct database connection, or via SQL injection in a vulnerable web application," the advisory said. "The vulnerability has been successfully used to execute arbitrary code on a lab machine."

SEC Consult has confirmed the flaw in the 2000 and 2005 versions of SQL Server. It has not yet tested version 2008. It triggers the rewriting of a computer's memory by supplying several uninitialized variables to the sp_replwritetovarbin stored procedure. Microsoft was alerted to the bug in April, according to SEC Consult.

There are no reports of the bug being attacked in the wild, a Microsoft spokesman said.

It's shaping up as quite a week for security professionals. Combined with bugs in IE 7 and the WordPad text converter for Word 97, the world now has three Microsoft zero-day vulnerabilities on its hands. And they come on the heels of Tuesday's release of fixes for 28 vulnerabilities, the biggest patch batch in five years.

"We're running at full speed right just to keep up with all that," said Rick Howard, intelligence director for iDefense, a security lab owned by VeriSign. "Twenty-eight is a lot, so while everybody is working to patch those things, a zero-day is sort of floating out there and not getting all the attention it would have gotten if it came out out of cycle."

So far, reports indicate that relatively few attacks are targeting the IE flaw, but now that attack code has been publicly released, Howard expects that to change.

Mary Landesman, a researcher at ScanSafe, a company that provides malware scanning services for large companies, seconds that prediction and said she's already seeing an increase. In just the past few days, she said, ScanSafe has observed four times as many attacks targeting the IE 7 flaw than attacks resulting from the widely reported Koobface worm.

What's more, the IE vulnerability is particularly pernicious. It has the ability to completely hijack a machine simply by visiting the wrong site. According to Howard, attackers are catching victims off-guard by compromising legitimate websites and then inserting an iframe that causes those using IE 7 to be hit.

The best way to protect yourself against the IE attack is to stop using the browser until it's been patched. For those who simply must use it, Microsoft has a list of recommendations that can be accessed by going here and expanding the workarounds section. ®

Next gen security for virtualised datacentres

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Scale data protection with your virtual environment
To scale at the rate of virtualization growth, data protection solutions need to adopt new capabilities and simplify current features.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?