Microsoft Database Engine Vulnerabilities Patched

guest · Aug 5, 2021

Microsoft Database Engine Vulnerabilities Patched
Exploits Could Enable Remote Attacks on MS IIS and SQL
August 4, 2021
https://www.govinfosecurity.com/microsoft-database-engine-vulnerabilities-patched-a-17213

Researchers at Palo Alto Networks' Unit 42 say they have demonstrated how exploits of Microsoft Jet Database Engine vulnerabilities could lead to remote attacks on Microsoft Internet Information Services and Microsoft SQL Server to gain system privileges. Microsoft recently patched the flaws.

Palo Alto Networks did not report on whether any exploits using the vulnerabilities were found in the wild, however Tao Yan, security researcher with the Palo Alto Networks' Unit 42 team tells Information Security Group that its researchers reported around 100 Jet vulnerabilities to Microsoft in 2020, but Microsoft only fixed a small number of them.

"It seems that Microsoft's strategy is to mitigate the whole attack surface instead of fixing each individual vulnerability, one by one," he says. Palo Alto Networks, he added, is still working with Microsoft to release a complete patch for both MS Jet and ACE.
Click to expand...

Most of the vulnerabilities could be used to attack IIS and SQL Server under SQL injection and ad hoc scenarios, the researchers say.

In addition, Palo Alto Networks says, "any components supporting MS Jet and ACE on Windows could be vulnerable, as long as the component allows users to execute any query on the controllable database with MS Jet and ACE."
Click to expand...

Microsoft has assigned the flaws the designation CVE-2021-28455 and released a patch.

Although the patch mitigates the risks, it is not turned on by default - and most Jet vulnerabilities are still not patched, Palo Alto Networks says.

"The mitigation for the attack surface in ACE still remains imperfect, and we are working with Microsoft to release a complete patch for both MS Jet and ACE," it adds.
Click to expand...

Log in or Sign up

Microsoft Database Engine Vulnerabilities Patched

guest Guest

Log in or Sign up

Microsoft Database Engine Vulnerabilities Patched

guest Guest

Useful Searches