Microsoft SQL Server Stored Procedure Low Privilege Weakness

Bugtraq ID:	5604
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 02 2002 12:00AM
Updated:	Sep 02 2002 12:00AM
Credit:	Reported by David Litchfield <[email protected]>.
Vulnerable:	Microsoft SQL Server 2000 SP2 Microsoft SQL Server 2000 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 Microsoft SQL Server 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft SQL Server Stored Procedure Low Privilege Weakness

Microsoft SQL Server 2000 uses various stored procedures to allow database administrators to perform simplified administration.

Two stored procedures within SQL Server allow the administrator to modify some SQL Server startup parameters and are also accessible by unprivileged users.

These stored procedures may not allow the server or its data to be compromised, however, they may be used in conjunction with other SQL Server vulnerabilities.

Microsoft SQL Server Stored Procedure Low Privilege Weakness

There is no exploit code necessary for this issue.

Microsoft SQL Server Stored Procedure Low Privilege Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft SQL Server Stored Procedure Low Privilege Weakness

References: