绿盟安全月刊->第7期->最新漏洞 MS SQL Server查询有效性检查漏洞

日期：2000-05-23

受影响的系统:牋
Microsoft Data Engine 1.0
牋 Microsoft Visual Studio 6.0
牋牋牋- Microsoft Windows NT 4.0
牋 Microsoft Access 2000
牋牋牋+ Microsoft Office 2000
牋牋牋牋 Microsoft Windows 98
牋牋牋牋 Microsoft Windows 95
牋牋牋牋 Microsoft Windows NT 4.0
牋牋牋牋 Microsoft Windows NT 2000.0
Microsoft SQL Server 7.0
牋 Microsoft Windows NT 4.0
牋 Microsoft BackOffice 4.5
牋牋牋- Microsoft Windows NT 4.0
--------------------------------------------------------------------------------
描述:


by Microsoft Security Bulletin

牋牋Microsoft SQL Serve 7.0和Data Engine（数据引擎）接收SQL查询时有可能造成数据库或系统被入侵。
任何经过SQL验证的用户都有可能能够通过SQL SELECT命令以数据拥有者或管理员权限执行命令。

--------------------------------------------------------------------------------
建议:

牋牋Microsoft公司提供以下安全补丁：

Microsoft Data Engine 1.0:

Microsoft patch s70780a (Alpha Version)
http://www.microsoft.com/downloads/release.asp?ReleaseID=19132

Microsoft patch s70780i (Intel Version)
http://www.microsoft.com/downloads/release.asp?ReleaseID=19132


Microsoft SQL Server 7.0:

Microsoft patch s70780a (Alpha Version)
http://www.microsoft.com/downloads/release.asp?ReleaseID=19132

Microsoft patch s70780i (Intel Version)
http://www.microsoft.com/downloads/release.asp?ReleaseID=19132