|
Microsoft JET Database Engine Buffer Overflow Vulnerability
|
|
Secunia Advisory:
|
SA9265
|
|
|
Release Date:
|
2003-07-16
|
|
Popularity:
|
12,632 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Privilege escalation
|
|
Where:
|
Local system
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Microsoft Access 2000
Microsoft Access 2002
Microsoft Data Access Components (MDAC) 2.x
Microsoft Office 2000
Microsoft Office XP
Microsoft SQL Server 2000
Microsoft SQL Server 2000 Desktop Engine (MSDE 2000)
Microsoft SQL Server 7
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
A vulnerability has been reported in Microsoft JET Engine, which can be exploited by malicious users to escalate their privileges on a vulnerable system.
The vulnerability is caused due to a boundary error when supplying an overly long (276 characters or more) function name to an SQL query. This will cause a buffer overflow potentially allowing execution of arbitrary code with higher privileges (eg. on SQL Server this will be with the SQL Server's privileges).
An example was provided in the original advisory:
SELECT * FROM OPENROWSET('microsoft.jet.oledb.4.0','c:\anydatabase.mdb';'admin';'','select XXX...[276]...XXX()')
The vulnerability has been reported to affect all software using Microsoft JET engine 4.0 with SP6 applied. However, prior versions may also be vulnerable.
The JET engine is eg. included in the following products:
- Microsoft SQL Server
- Microsoft Access
- Microsoft MSDE
- Microsoft MDAC (versions below 2.6)
Solution:
The vulnerability has been fixed in Microsoft JET engine Service Pack 7.
This is included in Windows 2000 Service Pack 4:
http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/default.asp
Service Pack 7 for the JET engine can be installed on other systems via WindowsUpdate or by following the procedures in the knowledge base articles referenced in "Other References".
Provided and/or discovered by:
Cesar Cerrudo
Other References:
Microsoft knowledge base articles:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;239114
http://support.microsoft.com/default.aspx?scid=kb;EN-US;282010
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
