Buffer Overrun in Microsoft Data Access Components New

A security vulnerability exists in the Microsoft Data Access Components (MDAC) which could allow an attacker to send a specially malformed HTTP request to overrun the buffer and run code of their choice on the system.

Issue

Microsoft Data Access Components (MDAC) is a collection of components used to provide database connectivity on Windows platforms. MDAC is a ubiquitous technology, and it is likely to be present on most Windows systems.

MDAC provides the underlying functionality for a number of database operations, such as connecting to remote databases and returning data to a client. One of the MDAC components, known as Remote Data Services (RDS), provides functionality that support three-tiered architectures – that is, architectures in which a client’s requests for service from a back-end database are intermediated through a web site that applies business logic to them. A security vulnerability is present in the RDS implementation, specifically, in a function called the RDS Data Stub, whose purpose it is to parse incoming HTTP requests and generate RDS commands.

A security vulnerability resulting from an unchecked buffer in the Data Stub affects versions of MDAC prior to version 2.7 (the version that shipped with Windows XP). By sending a specially malformed HTTP request to the Data Stub, an attacker could cause data of his or her choice to overrun onto the heap. Although heap overruns are typically more difficult to exploit than the more-common stack overrun, Microsoft has confirmed that in this case it would be possible to exploit the vulnerability to run code of the attacker’s choice on the user’s system.

Affected Products

• Microsoft Data Access Components (MDAC) 2.1
• Microsoft Data Access Components (MDAC) 2.5
• Microsoft Data Access Components (MDAC) 2.6
• Microsoft Internet Explorer 5.01
• Microsoft Internet Explorer 5.5
• Microsoft Internet Explorer 6.0

Download

Patch: http://www.microsoft.com/downloads/Release.asp?ReleaseID=44733

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: November 22, 2002

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<