Microsoft Issues 3 Patches, 1 Fixes Critical SQL Flaw

Microsoft Corp. released three security bulletins late Wednesday, including one with a patch for a critical flaw in its SQL Server database. The other two bulletins included patches for moderate threats to the Windows XP Help and Support Center and to a seldom-used feature of Word and Excel.

The flurry of security bulletins takes Microsoft to 61 bulletins so far in 2002, one more than the software giant issued for all of 2001. However, Microsoft is not close to issuing as many bulletins as it did in 2000, when the company put out 100 alerts.

The SQL Server flaw rates a "critical" designation on Microsoft's threat scale because it carries the possibility of an attacker elevating his privileges on a system. Both SQL Server 7.0 and SQL Server 2000 are vulnerable. To exploit the flaw, an attacker must be able to authenticate to the SQL Server and the server has to use a feature known as Web tasks.

More information on the vulnerability is available here.

Security Bulletin MS02-061 is the second major security bulletin for SQL Server this month and the fourth in the last four months.

Microsoft posted a patch for Windows XP Help and Support Center on Wednesday for a vulnerability that could allow an attacker to delete files on a user's system. The vulnerability is of the class that requires a user to open an HTML mail from an attacker or visit the attacker's Web site to exploit. More information on the vulnerability can be found here.

In another case of a seldom-used, whiz-bang feature turning out to be a vulnerability, Microsoft posted a bulletin for a problem with Word fields and Excel external updates. Both allow data from one document to be inserted to another document. Such features are a staple of Microsoft demos, where back-end databases constantly feed the latest corporate data into end user documents.

Turns out attackers can use the normally hidden fields to steal files from a user without the user's knowledge. The attacker would have to know the exact filename and entice the user to open the document, save it and return it to the attacker. Such an attack would leave an audit trail, if the victim ever became aware of it.

More information on the vulnerability can be found here.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • Microsoft Warns IT Pros on Windows Netlogon Fix Coming Next Month

    Microsoft on Thursday issued a reminder to organizations to ensure that their systems are properly patched for a "Critical"-rated Windows Netlogon vulnerability before next month's "update Tuesday" patch distribution arrives.

  • Microsoft Nudging Skype for Business Users to Teams

    Microsoft on Thursday announced some perks and prods for Skype for Business unified communications users, with the aim of moving them to the Microsoft Teams collaboration service instead.

  • How To Improve Windows 10's Sound and Video Quality

    Windows 10 comes with built-in tools that can help users get the most out of their sound and video hardware.

  • Microsoft Offers More 'Solorigate' Advice Using Microsoft 365 Defender Tools

    Microsoft issued yet another article with advice on how to use its Microsoft 365 Defender suite of tools to protect against "Solorigate" advanced persistent threat types of attacks in a Thursday announcement.

comments powered by Disqus