A vulnerability has been identified in SQL Server, which can be exploited by malicious, local users to escalate their privileges on a vulnerable system.

The vulnerability is caused due to a general error in the "CreateFile" API and an attack vector exists in SQL Server making it possible to gain the privileges of the SQL Server. This can be exploited by specifying the UNC name of a named pipe instead of a file as an argument to the "xp_fileexist" extended stored procedure.

An example is included in the original advisory.

Solution
Generally, only trusted administrators should be allowed access to a server. Furthermore, services should be run with as few privileges as possible.
Further details available to Secunia VIM customers

Provided and/or discovered by
Andreas Junestam (@stake)

Original Advisory
http://www.atstake.com/research/advisories/2003/a070803-1.txt

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers