Microsoft issued a security advisory late Monday, saying that the bug could be exploited to run unauthorized software on systems running versions of Microsoft SQL Server 2000 and SQL Server 2005.

Attack code that exploits the bug has been published, but Microsoft said that it has not yet seen this code used in online attacks. Database servers could be attacked using this flaw if the criminals somehow found a way to log onto the system, and Web applications that suffered from relatively common SQL injection bugs could be used as stepping stones to attack the back-end database, Microsoft said.

Desktop users running the Microsoft SQL Server 2000 Desktop Engine or SQL Server 2005 Express could be at risk in some circumstances, Microsoft said.

The bug lies in a stored procedure called “sp_replwritetovarbin,” which is used by Microsoft’s software when it replicates database transactions. It was publicly disclosed on December 9 by SEC Consult Vulnerability Lab, which said it had notified Microsoft of the issue in April.

“Systems with Microsoft SQL Server 7.0 Service Pack 4, Microsoft SQL Server 2005 Service Pack 3, and Microsoft SQL Server 2008 are not affected by this issue,” Microsoft said in its advisory.

This is the third serious bug in Microsoft’s software to be disclosed in the past month, but it is unlikely to be used in widespread attacks, according to Marc Maiffret, director of professional services, with The DigiTrust Group, a security consulting firm. “It is rather low risk given other vulnerabilities that exist,” he said via instant message. “There are a lot of better ways to currently compromise windows systems.”

After seeing the Internet Explorer flaw used in a growing number of online attacks, Microsoft rushed out an emergency patch for the issue last Wednesday. The company says it has also seen “limited and targeted attacks” exploiting a serious bug in the WordPad Text Converter for Word 97 files. As with the SQL bug, this WordPad converter vulnerability has not been patched, but is a prime candidate to be fixed in Microsoft’s upcoming January 13 security updates.

Original URL: http://www.pcworld.com/article/155940/microsoft_warns_of_sql_attack.html

The company is planning to have a launch event, called Heroes Happen Here, on February 27 that will be a public coming-out of Windows Server 2008, Visual Studio 2008, and SQL Server 2008.

Rather than release the final product at that time, Microsoft will have a “feature complete” preview, according to a Microsoft employee blog dedicated to SQL Server.

A release candidate for SQL Server 2008 will come out in second quarter with final general availability in the third quarter, according to the blog’s author, Francois Ajenstat, director of marketing for SQL Server.

The blog noted that the timing falls within Microsoft’s previously stated goal of getting SQL Server 2008 out two to three years after SQL Server 2005, which itself suffered from a series of significant delays.

Despite the delays with SQL Server 2005, it has been a successful product. Market research indicates that Microsoft’s database revenue is growing faster than that of rivals Oracle and IBM. Microsoft’s server and tools business is one of the company’s largest and fastest-growing divisions.

Original URL: http://www.news.com/8301-10784_3-9858439-7.html