SQL Server Cached Credentials Vulnerability

Reported June 13, 2001, byMicrosoft.

VERSIONS AFFECTED

DESCRIPTION
A vulnerability exists inMicrosoft SQL Server 2000 and SQL Server 7.0 that can let an attacker executeSQL queries using the systems administrator (sa) security context. When a userterminates a client connection to a SQL Server, the connection remains cachedfor a period of time because of performance reasons. One SQL query methodcontains this cache vulnerability, making it possible for an attacker to use thequery to reuse a cached connection that once belonged to the sa account. Anattacker can then take actions on the database (e.g., running code), and underthe right conditions, assume full control of the server.

VENDOR RESPONSE

Thevendor, Microsoft, has released securitybulletin MS01-032for this vulnerability, and recommends that users immediately apply the patchmentioned in Microsoft article "QueryMethod Used to Access Data May Allow Rights that the Login Might Not NormallyHave."

CREDIT
Discovered by Microsoft.