A vulnerability has been identified in SQL Server, which can be exploited by malicious, local users to escalate their privileges on a vulnerable system.
The vulnerability is caused due to a general error in the "CreateFile" API and an attack vector exists in SQL Server making it possible to gain the privileges of the SQL Server. This can be exploited by specifying the UNC name of a named pipe instead of a file as an argument to the "xp_fileexist" extended stored procedure.
An example is included in the original advisory.
Solution: Generally, only trusted administrators should be allowed access to a server. Furthermore, services should be run with as few privileges as possible.
Do you have additional information related to this advisory?
Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this
information to email@example.com
Subject: SQL Server Named Pipe Privilege Escalation Vulnerability
No posts yet
You must be logged in to post a comment.
Secunia Customer Login
Not a customer already?
Learn more about how our market leading Vulnerability Management solutions can help you manage risk and ensure compliance.