Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Apps :: m-091.txt

Microsoft Unchecked Buffer in SQLXML Vulnerability (CIAC M-091)




             __________________________________________________________

                       The U.S. Department of Energy
                   Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
             __________________________________________________________

                             INFORMATION BULLETIN

               Microsoft Unchecked Buffer in SQLXML Vulnerability
                     [Microsoft Security Bulletin MS02-030]

June 13, 2002 19:00 GMT                                           Number M-091
______________________________________________________________________________
PROBLEM:       Two vulnerabilities exist in Microsoft's SQLXML. The first 
               vulnerability is an unchecked buffer in an ISAPI extension that 
               could allow an attacker to run code of their choice on 
               Microsoft's IIS Server. The second vulnerability is a function 
               specifying an XML tag that could allow an attacker to run 
               script on a user's computer with higher privileges. 
PLATFORM:      Microsoft SQL Server 2000 
DAMAGE:        Exploiting these vulnerabilities can lead to an attacker 
               running code of choice, or an attacker to run script on a 
               user's computer, therefore escalating his or her privileges. 
SOLUTION:      Apply appropriate patches as prescribed by Microsoft. 
______________________________________________________________________________
VULNERABILITY  The risk is MEDIUM. An administrator must have set up a virtual 
ASSESSMENT:    directory structure and naming used by the SQLXML HTTP 
               components on an IIS Server. An attacker must know the location 
               of the virtual directory on the IIS Server in order to exploit 
               it. 
______________________________________________________________________________
LINKS: 
 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/m-091.shtml 
 ORIGINAL BULLETIN:                                                           
                     http://www.microsoft.com/technet/treeview/
                             default.asp?url=/technet/security/
                              bulletin/MS02-030.asp
______________________________________________________________________________

[***** Start Microsoft Security Bulletin MS02-030 *****]

Microsoft Security Bulletin MS02-030  

Unchecked Buffer in SQLXML Could Lead to Code Execution (Q321911)
Originally posted: June 12, 2002

Summary
Who should read this bulletin: System administrators using Microsoft® 
SQL Server™ 2000. 

Impact of vulnerability: Two vulnerabilities, the most serious of which could run 
code of attacker’s choice.

Maximum Severity Rating: Moderate

Recommendation: System administrators who have enabled SQLXML and enabled data 
queries over HTTP should install the patch immediately.

Affected Software:

Microsoft SQLXML, which ships as part of SQL Server 2000 and can be downloaded 
separately.

 Technical details

Technical description:

SQLXML enables the transfer of XML data to and from SQL Server 2000. Database 
queries can be returned in the form of XML documents which can then be stored or 
transferred easily. Using SQLXML, you can access SQL Server 2000 using XML 
through your browser over HTTP.

Two vulnerabilities exist in SQLXML: 

* An unchecked buffer vulnerability in an ISAPI extension that could, in the worst 
case, allow an attacker to run code of their choice on the Microsoft Internet 
Information Services (IIS) Server.
* A vulnerability in a function specifying an XML tag that could allow an attacker 
to run script on the user’s computer with higher privilege. For example, a script 
might be able to be run in the Intranet Zone instead of the Internet Zone.

Mitigating factors: 

Unchecked buffer in SQLXML ISAPI extension: 

* The administrator must have set up a virtual directory structure and naming used by 
the SQLXML HTTP components on an IIS Server. The vulnerability gives no means for an 
attacker to obtain the directory structure.
* The attacker must know the location of the virtual directory on the IIS Server that 
has been specifically set up for SQLXML.

Script injection via XML tag:

* For an attack to succeed, the user must have privileges on the SQL Server.
* The attacker must know the address of the SQL Server on which the user has privileges.
* The attacker must lure the user to a website under their control.
* Queries submitted via HTTP are not enabled by default.
* Microsoft best practices recommends against allowing ad hoc URL queries against the 
database through a virtual root.
* The script will run in the user’s browser according to the IE security zone used to 
connect with the IIS Server hosting the SQLXML components. In most cases, this will be 
the Intranet Zone.

Severity Rating: 

Unchecked buffer in SQLXML ISAPI extension:  Internet Servers Intranet Servers Client Systems
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft SQLXML version shipped with SQL 
Server 2000 Gold 				Moderate 	Moderate 	None
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft SQLXML version 2 			Moderate 	Moderate 	None
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft SQLXML versions 3 			Moderate 	Moderate 	None
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


Script injection via XML tag:  Internet Servers 	Intranet Servers   Client Systems
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft SQLXML version 
shipped with SQL Server 2000 
Gold 				Moderate 		Moderate 		None
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft SQLXML version 2 	Moderate 		Moderate 		None
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft SQLXML versions 3 	Moderate 		Moderate 		None
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
The above assessment is based on the types of systems affected by the vulnerability, their 
typical deployment patterns, and the effect that exploiting the vulnerability would have 
on them. The criticality is reckoned due to the possibility of remotely running code in the 
security context of the operating system and the possibility of running script on a user’s 
system with elevated privileges.

Vulnerability identifiers: 

* Unchecked buffer in SQLXML ISAPI extension - CAN-2002-0186
* Script injection via XML tag - CAN-2002-0187

Tested Versions:
Microsoft tested the original SQLXML version shipping with SQL Server 2000 Gold as well as 
SQLXML versions 1, 2 and 3 to assess whether they are affected by this vulnerability. 
SQLXML version 1 is no longer supported, and should be upgraded to a later version as 
discussed in the FAQ below.

Patch availability

Download locations for this patch

* Microsoft SQLXML version shipping with SQL 2000 Gold:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=39547
* Microsoft SQLXML version 2:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=38480
* Microsoft SQLXML version 3:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=38481

 Additional information about this patch

Installation platforms: 
This patch can be installed on systems running SQL Server 2000 SP2

Inclusion in future service packs:
The fix for this issue will be included in SQL Server 2000 SP3.

Reboot needed: Yes 

Superseded patches: None. 

Verifying patch installation: 

SQLXML shipping with SQL Server 2000 Gold: 

* To verify that the patch has been installed on the machine, confirm that the following 
registry key has been created on the machine:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\DataAccess\Q321858

SQLXML Version 2.0:

* To verify that the patch has been installed on the machine, confirm that the following 
registry key has been created on the machine:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\SQLXML 2.0\Q321460

SQLXML Version 3.0:

* To verify that the patch has been installed on the machine, confirm that the following 
registry key has been created on the machine:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\SQLXML 3.0\Q320833

Caveats:
None 

Localization:
This patch can be applied on all language versions. 

Obtaining other security patches: 
Patches for other security issues are available from the following locations:

* Security patches are available from the Microsoft Download Center, and can be most 
easily found by doing a keyword search for "security_patch".
* Patches for consumer platforms are available from the WindowsUpdate web site
* All patches available via WindowsUpdate also are available in a redistributable form 
from the WindowsUpdate Corporate site.

Other information:

Acknowledgments
Microsoft thanks Matt Moore of Westpoint Ltd. for reporting this issue to us and working 
with us to protect customers.

Support: 

* Microsoft Knowledge Base article Q321911 discusses this issue and will be available 
approximately 24 hours after the release of this bulletin. Knowledge Base articles can be 
found on the Microsoft Online Support web site.
* Technical support is available from Microsoft Product Support Services. There is no charge 
for support calls associated with security patches.

Security Resources: The Microsoft TechNet Security Web Site provides additional information 
about security in Microsoft products.

Disclaimer:
The information provided in the Microsoft Knowledge Base is provided "as is" without warranty
of any kind. Microsoft disclaims all warranties, either express or implied, including the
warranties of merchantability and fitness for a particular purpose. In no event shall
Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special damages, even if
Microsoft Corporation or its suppliers have been advised of the possibility of such damages.
Some states do not allow the exclusion or limitation of liability for consequential or
incidental damages so the foregoing limitation may not apply.

Revisions:

* V1.0 (June 12, 2002): Bulletin Created.

[***** End Microsoft Security Bulletin MS02-030 *****]

_______________________________________________________________________________

CIAC wishes to acknowledge the contributions of Microsoft Corporation for the 
information contained in this bulletin.
_______________________________________________________________________________


CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
    Voice:    +1 925-422-8193 (7x24)
    FAX:      +1 925-423-8002
    STU-III:  +1 925-423-2604
    E-mail:   ciac@ciac.org

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

   World Wide Web:      http://www.ciac.org/
   Anonymous FTP:       ftp.ciac.org

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins.  If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

M-081: SSHD "AllowedAuthentications" Vulnerability
M-082: Microsoft Cumulative Patch for Internet Explorer
M-083: Microsoft Authentication Flaw in Windows Debugger
M-084: Red Hat "pam_ldap" Vulnerability
M-085: IMAP Partial Mailbox Attritbute Buffer Overflow Vulnerability
M-086: Sun SEA SNMP Vulnerability
M-087: SGI IRIX rpc.passwd Vulnerability
M-088: MS Unchecked Buffer in Gopher Protocol Handler
M-089: MS Heap Overrun in HTR Chunked Encoding  Vulnerability
M-090: Microsoft Unchecked Buffer in RAS Phonebook Vulnerability


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH