← Advisories

Microsoft Source Code Analyzer for SQL Injection 1.3 Improper Permissions

Medium
Advisory ID
ZSL-2011-5003
Release Date
16 March 2011
Vendor
Microsoft Corporation - http://www.microsoft.com
Affected Version
1.3.30601.30705
CVE
N/A
Tested On
Microsoft Windows XP Professional SP3 (EN)
Summary

Microsoft Source Code Analyzer for SQL Injection is a static code analysis tool for finding SQL Injection vulnerabilities in ASP code. Customers can run the tool on their ASP source code to help identify code paths that are vulnerable to SQL Injection attacks.

Description

The package suffers from an elevation of privileges vulnerability which can be used by a simple user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the "C" flag (Change(write)) for the "Everyone" group, for the binary file msscasi_asp.exe and the package itself, msscasi_asp_pkg.exe.

Proof of Concept
Disclosure Timeline
12.03.2011Vendor is informed about the issue.
14.03.2011Vendor decides not to track the issue stating that it is not a security issue and that the tool is in its BETA stage.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
16.03.2011Initial release
17.03.2011Added reference [4] and [5]
22.03.2011Added reference [6] and [7]