Feeds

Security pros groan as zero-day hits Microsoft's SQL Server

Meanwhile, IE 7 attacks on the rise

Build a business case: developing custom apps

Yet another zero-day vulnerability has been identified in a popular Microsoft product, this time in its SQL Server database. The revelation comes as miscreants are stepping up attacks on a particularly nasty bug in the latest version of Internet Explorer.

The SQL Server bug could allow the remote execution of malicious code, according to researchers at Austria-based SEC Consult. The company said attackers exploiting the flaw would have to be authenticated users on the system, a requirement that a Microsoft spokesman also said minimizes the risk. But an SEC Consult advisory warned it's still possible for outsiders to target the vulnerability remotely on websites that link search boxes, customer data bases or other web apps to SQL Server.

"The vulnerability can be exploited by an authenticated user with a direct database connection, or via SQL injection in a vulnerable web application," the advisory said. "The vulnerability has been successfully used to execute arbitrary code on a lab machine."

SEC Consult has confirmed the flaw in the 2000 and 2005 versions of SQL Server. It has not yet tested version 2008. It triggers the rewriting of a computer's memory by supplying several uninitialized variables to the sp_replwritetovarbin stored procedure. Microsoft was alerted to the bug in April, according to SEC Consult.

There are no reports of the bug being attacked in the wild, a Microsoft spokesman said.

It's shaping up as quite a week for security professionals. Combined with bugs in IE 7 and the WordPad text converter for Word 97, the world now has three Microsoft zero-day vulnerabilities on its hands. And they come on the heels of Tuesday's release of fixes for 28 vulnerabilities, the biggest patch batch in five years.

"We're running at full speed right just to keep up with all that," said Rick Howard, intelligence director for iDefense, a security lab owned by VeriSign. "Twenty-eight is a lot, so while everybody is working to patch those things, a zero-day is sort of floating out there and not getting all the attention it would have gotten if it came out out of cycle."

So far, reports indicate that relatively few attacks are targeting the IE flaw, but now that attack code has been publicly released, Howard expects that to change.

Mary Landesman, a researcher at ScanSafe, a company that provides malware scanning services for large companies, seconds that prediction and said she's already seeing an increase. In just the past few days, she said, ScanSafe has observed four times as many attacks targeting the IE 7 flaw than attacks resulting from the widely reported Koobface worm.

What's more, the IE vulnerability is particularly pernicious. It has the ability to completely hijack a machine simply by visiting the wrong site. According to Howard, attackers are catching victims off-guard by compromising legitimate websites and then inserting an iframe that causes those using IE 7 to be hit.

The best way to protect yourself against the IE attack is to stop using the browser until it's been patched. For those who simply must use it, Microsoft has a list of recommendations that can be accessed by going here and expanding the workarounds section. ®

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
Plug and PREY: Hackers reprogram USB drives to silently infect PCs
BadUSB instructs gadget chips to inject key-presses, redirect net traffic and more
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?