Security pros groan as zero-day hits Microsoft's SQL Server

Yet another zero-day vulnerability has been identified in a popular Microsoft product, this time in its SQL Server database. The revelation comes as miscreants are stepping up attacks on a particularly nasty bug in the latest version of Internet Explorer.

The SQL Server bug could allow the remote execution of malicious code, according to researchers at Austria-based SEC Consult. The company said attackers exploiting the flaw would have to be authenticated users on the system, a requirement that a Microsoft spokesman also said minimizes the risk. But an SEC Consult advisory warned it's still possible for outsiders to target the vulnerability remotely on websites that link search boxes, customer data bases or other web apps to SQL Server.

"The vulnerability can be exploited by an authenticated user with a direct database connection, or via SQL injection in a vulnerable web application," the advisory said. "The vulnerability has been successfully used to execute arbitrary code on a lab machine."

SEC Consult has confirmed the flaw in the 2000 and 2005 versions of SQL Server. It has not yet tested version 2008. It triggers the rewriting of a computer's memory by supplying several uninitialized variables to the sp_replwritetovarbin stored procedure. Microsoft was alerted to the bug in April, according to SEC Consult.

There are no reports of the bug being attacked in the wild, a Microsoft spokesman said.

It's shaping up as quite a week for security professionals. Combined with bugs in IE 7 and the WordPad text converter for Word 97, the world now has three Microsoft zero-day vulnerabilities on its hands. And they come on the heels of Tuesday's release of fixes for 28 vulnerabilities, the biggest patch batch in five years.

"We're running at full speed right just to keep up with all that," said Rick Howard, intelligence director for iDefense, a security lab owned by VeriSign. "Twenty-eight is a lot, so while everybody is working to patch those things, a zero-day is sort of floating out there and not getting all the attention it would have gotten if it came out out of cycle."

So far, reports indicate that relatively few attacks are targeting the IE flaw, but now that attack code has been publicly released, Howard expects that to change.

Mary Landesman, a researcher at ScanSafe, a company that provides malware scanning services for large companies, seconds that prediction and said she's already seeing an increase. In just the past few days, she said, ScanSafe has observed four times as many attacks targeting the IE 7 flaw than attacks resulting from the widely reported Koobface worm.

What's more, the IE vulnerability is particularly pernicious. It has the ability to completely hijack a machine simply by visiting the wrong site. According to Howard, attackers are catching victims off-guard by compromising legitimate websites and then inserting an iframe that causes those using IE 7 to be hit.

The best way to protect yourself against the IE attack is to stop using the browser until it's been patched. For those who simply must use it, Microsoft has a list of recommendations that can be accessed by going here and expanding the workarounds section. ®