Secunia

A vulnerability has been reported in Microsoft JET Engine, which can be exploited by malicious users to escalate their privileges on a vulnerable system.

The vulnerability is caused due to a boundary error when supplying an overly long (276 characters or more) function name to an SQL query. This will cause a buffer overflow potentially allowing execution of arbitrary code with higher privileges (eg. on SQL Server this will be with the SQL Server's privileges).

An example was provided in the original advisory:
SELECT * FROM OPENROWSET('microsoft.jet.oledb.4.0','c:\anydatabase.mdb';'admin';'','select XXX...[276]...XXX()')

The vulnerability has been reported to affect all software using Microsoft JET engine 4.0 with SP6 applied. However, prior versions may also be vulnerable.

The JET engine is eg. included in the following products:
- Microsoft SQL Server
- Microsoft Access
- Microsoft MSDE
- Microsoft MDAC (versions below 2.6)

Solution
The vulnerability has been fixed in Microsoft JET engine Service Pack 7.
Further details available in Customer Area

Provided and/or discovered by
Cesar Cerrudo

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area