Microsoft owns up to "critical" SQL hole

Microsoft has discovered "critical" holes in its SQL server product which could allow a malicious attacker to gain control of a machine.

The flaw is the most serious one to be fixed in a raft of security patches issued by the software giant today.

These include the re-issuing of another "critical" patch - this time for its media player - because the original patch wasn't complete.

Microsoft said two of the holes discovered in SQL server were buffer overflow vulnerabilities. One could cause SQL to crash and the other could allow malicious code to be executed.

A third vulnerability could allow a denial of service attack to be performed. The vulnerabilities were discovered by David Litchfield of Next Generation Security Software.

Microsoft also issued four other patches today, fixing further holes in SQL server, metadirectory services, its SMTP client and the media player.

Patches are available at
http://www.microsoft.com/technet