• News
• Infocus
• Foundations
• Microsoft
• Unix
• IDS
• Incidents
• Virus
• Pen-Test
• Firewalls
• Columnists
• Mailing Lists
• Newsletters
• Bugtraq
• Focus on IDS
• Focus on Linux
• Focus on Microsoft
• Forensics
• Pen-test
• Security Basics
• Vuln Dev
• Vulnerabilities
• Jobs
• Job Opportunities
• Resumes
• Job Seekers
• Employers
• Tools
• RSS
• News
• Vulns
• Security Research

• info
• discussion
• exploit
• solution
• references

Microsoft SQL Server SQLXML Script Injection Vulnerability

Solution:
Microsoft has released the following patches which rectify this issue:


Microsoft SQL Server 2000

• Microsoft SQLXML2_Q321460
  For SQL Server 2000 Client Tools installed and SQLXML Web Release 2
  http://download.microsoft.com/download/SQLSVR2000/Patch/Q321460/W98NT4 2KMe/EN-US/SQLXML2_Q321460.EXE

Microsoft SQL Server 2000 SP1

• Microsoft SQLXML2_Q321460
  For SQL Server 2000 Client Tools installed and SQLXML Web Release 2
  http://download.microsoft.com/download/SQLSVR2000/Patch/Q321460/W98NT4 2KMe/EN-US/SQLXML2_Q321460.EXE

Microsoft SQL Server 2000 SP2

• Microsoft Q321858_SQL_Security_MDAC26
  For SQL Server 2000 Gold MDAC26
  http://download.microsoft.com/download/SQLSVR2000/SQLXML/Q321858/NT45X P/EN-US/Q321858_SQL_Security_MDAC26.exe


• Microsoft Q321858_SQL_Security_MDAC27
  For SQL Server 2000 Gold MDAC27
  http://download.microsoft.com/download/SQLSVR2000/SQLXML/Q321858/NT45X P/EN-US/Q321858_SQL_Security_MDAC27.exe


• Microsoft SQLXML2_Q321460
  For SQL Server 2000 Client Tools installed and SQLXML Web Release 2
  http://download.microsoft.com/download/SQLSVR2000/Patch/Q321460/W98NT4 2KMe/EN-US/SQLXML2_Q321460.EXE


• Microsoft SQLXML3_Q320833
  For SQL Server 2000 Client Tools installed and SQLXML Web Release 3
  http://download.microsoft.com/download/SQLSVR2000/Patch/Q320833/W98NT4 2KMe/EN-US/SQLXML3_Q320833.EXE