Microsoft SQL Server SQLXML XML tag script injection
| mssql-sqlxml-script-injection (9329) |  High Risk |
Description:
Microsoft SQLXML, included as part of Microsoft SQL Server 2000 Gold or available as a separate add-on component for SQL Server, could allow a remote attacker to execute arbitrary script on the system, caused by improper validation of the "Root" parameter in an XML SQL query. SQLXML is a component used to exchange Extensible Markup Language (XML) data with a SQL server. A remote attacker could include malicious script within the "Root" parameter of an XML SQL query. This would allow the attacker to create a link on a Web page that calls a vulnerable XML SQL query. After the victim clicks the link, the script would be executed in the victim's Web browser within the security context of the local Intranet Zone, once a reply is received from the SQL Server running the SQLXML component.
Platforms Affected:
- Microsoft, SQL Server 2000
- Microsoft, SQL Server 2000 Gold
- Microsoft, SQLXML 2
- Microsoft, SQLXML 3
- Microsoft, Windows 2003 Server
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS02-030. See References.
Consequences:
Gain Access
References:
- CERT Advisory CA-2002-22, Multiple Vulnerabilities in Microsoft SQL Server at http://www.cert.org/advisories/CA-2002-22.html.
- CIAC Information Bulletin M-091, Microsoft Unchecked Buffer in SQLXML Vulnerability at http://www.ciac.org/ciac/bulletins/m-091.shtml.
- Microsoft Security Bulletin MS02-030, Unchecked Buffer in SQLXML Could Lead to Code Execution (Q321911) at http://www.microsoft.com/technet/security/bulletin/ms02-030.mspx.
- Westpoint Security Advisory wp-02-0007.txt, Microsoft SQLXML ISAPI Overflow and Cross Site Scripting at http://www.westpoint.ltd.uk/advisories/wp-02-0007.txt.
- BID-5005: Microsoft SQL Server SQLXML Script Injection Vulnerability
- CVE-2002-0187: Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute arbitrary script via the root parameter as part of an XML SQL query, aka Script Injection via XML Tag.
- US-CERT VU#139931: Microsoft SQLXML HTTP components vulnerable to cross-site scripting via root parameter
Reported:
Jun 12, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net