"Microsoft is warning users of a zero-day
vulnerability discovered in SQL Server, and that exploits of the flaw
have already been published.
The software giant yesterday issued a security advisory
outlining a flaw that could allow remote code execution on many
versions of SQL Server. The company has not had time to develop a
patch, but it is offering some "workarounds" that it says will
alleviate the problem.
Although exploits are out on the Internet, "Currently, Microsoft is not
aware of active attacks that use this exploit code or of customer
impact at this time," the advisory states.
According to one source, the initial exploit was published by
the same "researcher" who discovered the flaw. "This is an example of
irresponsible disclosure," says Eric Schultze, CTO at Shavlik
Technologies. "The person that found that issue took the proper steps
to report it to Microsoft. However, they grew impatient with Microsoft
and decided to release exploit code before Microsoft announced a patch.
"This so-called security researcher has therefore placed
thousands of servers and potentially untold number of persons'
personally identifiable information at risk for purposes of their own
popularity," Schultze continues."
Read more: http://darkreading.com/security/vulnerabilities/showArticle.jhtml?articleID=212501884
