[25941] in bugtraq
New Paper - Violating Database Enforced Security Mechanisms
daemon@ATHENA.MIT.EDU (Chris Anley)
Wed Jun 26 12:13:33 2002
Message-ID: <001801c21bab$a1a025e0$4201010a@kodiak>
From: "Chris Anley" <chris@ngssoftware.com>
To: <bugtraq@securityfocus.com>
Date: Mon, 24 Jun 2002 19:19:04 +0100
Hi folks,
I've written a paper on runtime patching of database server code, which can
be found here:
http://www.ngssoftware.com/papers/violating_database_security.pdf
It discusses "runtime patching" exploits, specifically in the context of
Microsoft SQL Server 2000, but the techniques apply to a wide variety of
targets. The paper also documents a three byte patch that disables access
control in SQL Server, resulting (by way of some tricks) in sysadmin access
for all.
I think this kind of exploit is pretty dangerous and well worth thinking
about, hence the paper. As always, any questions, comments, flames etc will
be gratefully received. Well, received, anyhow. :o)
-chris.
