Vulnerability Note VU#818939

Overview

MS SQL Server contains an extended stored procedure with inappropriate permission settings.

Description

Microsoft SQL Server 7.0 and Microsoft SQL Server 2000 contain an extended stored procedure, xp_displayparamstmt, that permits an unprivileged user of a database to gain administrative access to the database. For more information, please see http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-043.asp and http://www.ngssoftware.com/advisories/mssql-esppu.txt This vulnerability was discovered David Litchfield of NGSSoftware.

Impact

An intruder can gain administrative access to a vulnerable SQL Server database.

Solution

Apply a patch as described in http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-043.asp.

Systems Affected (Learn More)

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Affected	-	16 Aug 2002

If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group	Score	Vector
Base	N/A	N/A
Temporal	N/A	N/A
Environmental	N/A	N/A

References

• http://www.microsoft.com/technet/security/bulletin/MS02-043.asp
• http://www.ngssoftware.com/advisories/mssql-esppu.txt

Credit

Thanks to David Litchfield for reporting this vulnerability.

This document was written by Shawn V Hernan.

Other Information

• CVE IDs: CAN-2002-0721
• Date Public: 16 Aug 2002
• Date First Published: 16 Aug 2002
• Date Last Updated: 16 Aug 2002
• Severity Metric: 12.66
• Document Revision: 3