JET engine flaws can crash Microsoft's IIS, SQL Server, say Palo Alto researchers
- Reference: 1620277188
- News link: https://www.theregister.co.uk/2021/05/06/jet_engine_flaws_attack_iis_sql/
- Source link:
The team also said Microsoft dismissed some of their findings as not worthy of a fix.
In a talk today at Black Hat Asia titled [1]Give Me a SQL Injection, I Shall PWN IIS and SQL Server , the three explained they found the JET engine – for years an [2]underlying tech for Microsoft Access and other products, and still downloadable today – has many vulnerabilities. We've [3]previously reported on such holes.
[4]
[5]
[6]
Senior principal researcher Tao Yan, principal researcher Qi Deng, and senior distinguished engineer Bo Qu explained it is possible to configure JET to access and query remote databases.
While JET was not designed to do so, the researchers showed that it's possible to designate JET as a "related provider" to SQL Server.
Tao said access to the databases also requires what he called a “hidden” method that involved combining SMB and WebDAV. That combo can also be used to create files on IIS and SQL Server hosts.
[7]
Once JET and SQL Server are linked, and the SMB/WebDAV connection made, JET users can send queries to SQL Server. If those queries happen to be SQL injections, they can ultimately crash the SQL Server, or worse. The team demoed that and similar SQL injections taking down Internet Information Server.
“You can get remote system privileges with only an SQL injection,” Tao declared.
[8]Microsoft revokes MVP status of developer who tweeted complaint about request to promote SQL-on-Azure
[9]If you have a QNAP NAS, stop what you're doing right now and install latest updates. Do it before Qlocker gets you
[10]Proof of concept code published for latest Saltstack CVE: Don't be an update laggard
[11]
The trio's advice ... Pay attention to WebDAV. Click to enlarge
The researchers said they shared their work with Microsoft, and the software giant has rebuffed them on the grounds that the problems identified do not cross a defined security boundary.
Tao found that concerning, given that millions of devices already running JET have the potential to be used for evil.
Tao said the three believe Microsoft will eventually patch JET, and they will withhold details of their findings until such remedies arrive. He added he has no firm indication of when the Windows titan plans to deliver such a fix. ®
Get our [12]Tech Resources
[1] https://www.blackhat.com/asia-21/briefings/schedule/#give-me-a-sql-injection-i-shall-pwn-iis-and-sql-server-22251
[2] https://en.wikipedia.org/wiki/Microsoft_Jet_Database_Engine
[3] https://www.theregister.com/2018/09/20/microsoft_jet_database_zero_day/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YJO@PGMQQldrSTdCeXOPlAAAAE4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJO@PGMQQldrSTdCeXOPlAAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJO@PGMQQldrSTdCeXOPlAAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJO@PGMQQldrSTdCeXOPlAAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] http://www.theregister.com/2021/04/21/microsoft_revokes_mvp_status/
[9] http://www.theregister.com/2021/04/22/qnap_nas_ransomware_qlocker_ech0raix/
[10] http://www.theregister.com/2021/03/03/saltstack_cve_poc_exploit_code/
[11] https://regmedia.co.uk/2021/05/06/give_me_a_sql_injection_i_shall_pwn_iis_and_sql_server.jpg
[12] https://whitepapers.theregister.com/
First, a standard issue install of Office does not include Access, much less SQL Server.
Second, what they're talking about is effectively an escalation vulnerability that affects you when someone with privileged access to a JET engine also has privileged access to a SQL server. That's why it's not a priority to fix: the answer is "well, don't give that kind of privilege to people you don't trust, then". Frankly, anyone who is vulnerable to this already has much bigger things to worry about.
I've not read the fine print, but it sounds like this is only an issue if you do something foolish involving linking SQL Server to Access.
Nobody in their right mind should be using Access as anything beyond a toy database, and the idea of creating a Frankenstein's monster of Access and SS gives me the shivers.
That said, it used to be possible to bring down the SQL Server process (I think it was SS 2005) simply by executing a query with too many discrete items in an IN clause (more than a couple of thousand IIRC) over ODBC, so something like the following:
SELECT * FROM Customers WHERE CustomerId IN (1, 2, ... 99999, 100000)
Of course it's a code smell to be writing a query like that anyway, but we had a need to do so due to a load of technical debt we couldn't do away with, and it took a while to work out why the connection to the database kept getting dropped in the middle of some heavy processing.
My money's on this issue being that old chestnut of an unchecked buffer overflow.
MicroSoft's response
Go away, little people. Stop bothering us.
So just about every pc with ms office then
Fixed when spooks say so I guess