Signature Detail
Short Name |
DB:MS-SQL:2000-SP_START_JOB |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
DB |
Keywords |
MS-SQL SP_START_JOB Program Execution |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
DB: MS-SQL SP_START_JOB Program Execution
This signature detects attempts to use the sp_start_job command on a Microsoft SQL Server 2000 database. A successful attack can allow the attackers to execute arbitrary code.
Extended Description
Microsoft SQL Server 2000 uses an Agent which is responsible for restarting the SQL Server service, replication, and running scheduled jobs. Some of the jobs that the Agent executes have weak permissions, which could allow a user with low permissions to perform actions on the database in the context of the SQL Server Service Account when used in conjunction with the Microsoft SQL Server Extended Stored Procedure Privilege Elevation Vulnerability (BID 5481).
Affected Products
- Microsoft Data Engine 2000
- Microsoft Data Engine (MSDE) 1.0
- Microsoft SQL Server 7.0
- Microsoft SQL Server 7.0 SP1
- Microsoft SQL Server 7.0 SP2
- Microsoft SQL Server 7.0 SP3
- Microsoft SQL Server 7.0 SP4
- Microsoft SQL Server 2000 SP1
- Microsoft SQL Server 2000 SP2
- Microsoft SQL Server 2000
References