[14352] in bugtraq
SQL Server Vulnerability details
daemon@ATHENA.MIT.EDU (Chip Andrews)
Mon Mar 20 07:19:49 2000
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <00b901bf912b$01774c40$0101a8c0@brutus>
Date: Sat, 18 Mar 2000 17:40:48 -0500
Reply-To: Chip Andrews <chipandrews@USA.NET>
From: Chip Andrews <chipandrews@USA.NET>
X-To: bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
Due to the apparent blackout of information about the "SQL Query Abuse"
advisory http://www.microsoft.com/technet/security/bulletin/ms00-014.asp I
wanted to point any interested parties to an English description of the
vulnerability by Sven Hammesfahr. The detailed description is on his
website at
http://itrain.de/sql/knowhow/security/openrowsete.htm
Also, the "little trick" he refers to is in my opinion the addition of SET
FMTONLY OFF before the execute statement to keep the query from returning
metadata only. An example exploit would be:
SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data
Source=myserver','SET FMTONLY OFF execute master..xp_cmdshell "dir c:\"')
Test your servers ASAP to keep from becoming a statistic...
-----------------------------------------
Chip Andrews, MCSE+I, MCSD
http://www.sqlsecurity.com
http://www.eexams.com
------------------------------------------
