FIX: Patch Available for Script Injection with XML Tag and Unchecked Buffer in SQLXML ISAPI Extension Vulnerabilities (321460)

SYMPTOMS

Microsoft has released a patch that corrects the following two vulnerabilities in SQLXML.

The first vulnerability is an elevation of privilege vulnerability. An attacker who is able to successfully exploit this vulnerability can cause scripts to run on another user's system in the Microsoft Internet Explorer Security Zone associated with the Microsoft Internet Information Services (IIS) server that is running SQLXML HTTP components. This vulnerability is subject to a number of significant mitigating factors:

• It can only be exploited against a user who has permissions to query an affected computer that is running SQL Server.
• The attacker must possess significant information, including the name of the affected computer that is running SQL Server.
• In most cases, the script runs in the Intranet Zone, which has no significant differences from the security zone that the attacker's own Web site would be placed in.

The second vulnerability is a buffer overrun vulnerability. An attacker who successfully exploits this vulnerability might gain complete control over an affected database server. This would give the attacker the ability to add, delete, or change any data on the server, reformat the hard disk, or take other actions. This vulnerability can only be exploited if the administrator sets up and enables the SQLXML HTTP components on a Microsoft Internet Information Services (IIS) server.