Bonum Certa Men Certa

Microsoft SQL Server and DirectX Enable Full Machine Compromise

Network server
Microsoft still the weakest link in networked computing



Summary: Complete systems compromised, all caused by proprietary Microsoft software and APIs

YESTERDAY WE wrote about Windows compromising the national security of the United States. It is now confirmed that a Microsoft component is the culprit. It's not just Windows though; it's apparently Microsoft SQL Server, according to CNET.

Investigators believe an SQL injection attack was used to exploit a vulnerability in Microsoft's SQL Server database in order to gain access to the servers.


How can a database lead to full compromise? It's surely a design problem and we append at the bottom some references of interest, including the fairly recent news about head of Microsoft SQL Server quitting Microsoft.

As Oiaohm put it, "Does MySQL on Linux run as a root user? Not running as root lowers the damage [...] Has happened in the past with old Microsoft SQL worms. [...] We don't know how old [a] Microsoft SQL Server this was."

In CNET, we have also found this report about a DirectX hole which enables the entire system to be compromised. This is madness. How can a proprietary API achieve this? Is it truly as insecure-by-design as ActiveX? Many examples of ActiveX nightmares are accumulated here.

Microsoft on Thursday said it is working on a security patch for a vulnerability in its DirectX streaming media technology in Windows that could allow someone to take complete control of a computer using a maliciously crafted QuickTime file.


Marvelous. Why not just stick to open and free APIs like OpenGL? _______ [1] Database head to leave daily duties at Microsoft

Paul Flessner, who leads Microsoft's data storage and platform division, will step down from his daily duties after the new year.


[2] New attack technique threatens databases

A noted database security expert, Litchfield is perhaps best known for uncovering a bug in Microsoft SQL Server database server that was subsequently used by the SQL Slammer worm. Litchfield has long criticised Oracle for the time it takes to fix vulnerabilities in its database software. € 


[3] SQL Injection Attacks on IIS Web Servers

[4] Microsoft offers assistance to combat mass SQL injection

[5] Huge Web Hack Attack Infects 500,000 Pages

One anti-virus vendor said the sites might have been compromised through a "security issue" in Microsoft's Web server software that has been reported to Microsoft's engineers. € 


[6] Study Says Linux More Secure

More than 70 percent people surveyed said they found Red Hat Linux less vulnerable to security issues than Microsoft's operating system.


[7] Study: 70 percent say Red Hat more secure than Windows

[8] Microsoft officially 425 years behind the times

It's not just Excel and Exchange that ignore the Gregorian calendar. The Reg has also confirmed that SQL Server 2008, Windows Small Business Server, and Windows Mobile are ignorant as well. € 


[9] SQL Server 2005 SP1 won't work with Vista

It's no secret that a number of applications, including several of Microsoft?s own, are not going to work properly with Windows Vista when the product ships.


[10] SQL Server 2005 SP2 Critical Update Available

Microsoft is seeking to resolve a technical glitch caused by Service Pack 2. For some installations, cleanup tasks stop prematurely after applying the service pack.

The hotfix, which Microsoft has designated a "critical update," is available for existing SQL Server 2005 installations with Service Pack 2.


[11] Vista-compatible SQL Server 2005 SP2 likely February 19

Microsoft began warning users of SQL Server 2005 Vista incompatibilities last Fall.


[12] Vista flaw could haunt Microsoft

Microsoft wants a bigger piece of Oracle and IBM's database business, but an oversight in its new operating system could cost the company plenty.


Recent Techrights' Posts

PCLinuxOS is Raising Money to Support Development After Fire Incident at the Host
PCLinuxOS has not had announcements lately
Over 3 Months Later Brett Wilson LLP Still Unable to Recruit a Media Lawyer?
"Immediate start", but not found... still unfilled
Microsoft is Trying to "Pull a Nokia" on GNU/Linux as Desktop/Laptop Platform
We all remember that rather well, don't we?
Our Three Lawsuits Against Microsofters Are About to Become a Lot More Relevant to GNU/Linux
The Master will easily understand why Garrett has been attacking me since 2012
 
Microsoft Hiring European Politicians is Another Form of Bribery; There Should be a European Investigation
When Microsoft bribed people in Europe for OOXML (there's no denying this!) a European government delegate said that Microsoft operated like a cult
Reda Demanded That FSF Removes Its Founder, Now Reda Works Directly for Microsoft
A sellout and a traitor, first working for GAFAM, now Microsoft
Speed of the Site Should be Better Now
The "bot attacks" impact the speed of the sister site too
Getting More From AnalogNowhere
Recently we used many images from AnalogNowhere
Microsoft, Microsofters and 'Secure' Boot Shills Already Storming the LWN Report About Expiring Certificate, Shooting the Messenger
LWN has clearly stuck a nerve
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, July 23, 2025
IRC logs for Wednesday, July 23, 2025
Disable "Secure" Boot Today (the Only Better Time to Do So Was Yesterday)
Don't trust anything Red Hat tells you about security
Links 23/07/2025: Windows Killed Company After 150+ Years, US Government Mimics Russia's Attacks on the Media
Links for the day
Freedom Generally Wins at the End, History Shows (But It's Constantly Attacked, Too)
At the moment people realise "Linux" (e.g. Android) isn't enough to guarantee any freedoms
“Inhumane” and “Disgusting” Mass Layoff Execution, According to Microsoft Staff
The workers are looking for other places to work
Misinformation is Not Intelligence
It's low-grade plagiarism and it fails to show any signs of intelligence
The Free Software Foundation (FSF) Has a New Slogan for Its 40th Anniversary
The freedoms are what's most important
LLM Slopfarms gbhackers.com, "Cyber Press" and CyberSecurityNews Are Drowning Google News (and Shame on Google for Feeding and Facilitating Them)
All are run by the same people
Links 23/07/2025: Droplets GUI Patent Monopoly Challenge, Nokia Leverages Illegal Patent Court Against Rivals
Links for the day
Gemini Links 23/07/2025: Community in Geminispace and Challenges With Old Computers
Links for the day
Links 23/07/2025: Slop Patents Tackled, Slop Copyright Misuses Tackled by Politicians
Links for the day
Links 23/07/2025: Retreating From Transparency on Jeffrey Epstein, We No Longer Have Press Freedom
Links for the day
Gemini Links 23/07/2025: Piano and Food
Links for the day
New and Old
On Ageism in Tech
Slop Is Not Intelligence and It Does Not Enhance Productivity
Like voice dictation, which cannot tell the difference between "sheet" and "shit"
EPO Crimes Are Spreading to the British Court System
Society is now paying the price for failing to tackle crimes at the EPO
It's Time to Dump SharePoint and Here's What to Use Instead
Nextcloud, ownCloud, Bookstack, MediaWiki, and MediaGoblin
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, July 22, 2025
IRC logs for Tuesday, July 22, 2025
Brett Wilson LLP Has Gone Silent
Sometimes silence says more than nothing at all
Slopwatch: LinuxSecurity, Planet Ubuntu, and LinuxTechLab
some slopfarms show no remorse and they don't value their reputation at all
Links 23/07/2025: Book Bans, Storms, and Kangaroo Court for Patents Commits More Unlawful Acts of Overreach
Links for the day
Gemini Links 22/07/2025: Thinkpad and Pinephone
Links for the day
Links 22/07/2025: "Blog Restart" and Microsoft Clobbered by “ToolShell"
Links for the day
Global Warming and Global GAFAM Energy-Wasting
Burn more money (borrowed, loans), then hope the waste will somehow translate into profit?
No Compliance With the European Patent Convention (EPC) at the European Patent Office (EPO)
It's about preventing competition against this autocracy
Blue-Collar Trolls vs White-Collar Trolls
Examples of white-collar trolls
Apple Vision Pro Failed So Badly That Its Sales Are About 2,000 Times Smaller Than iPhone Sales
What's left for Apple to offer other than hype?
To Millions of People "Year of the Linux Desktop" Was Some Time in the 1990s (Bootable GNU/Linux as a Complete Operating System is Over 33 in Age)
In some sense, "year of the Linux desktop" was 33 years ago
Make No Assumptions (or Demands) About the Screen Resolution Used by Other People
There are usability aspects, aside from accessibility aspects
Why Wayland (and XWayland) Won't Solve the Key Problem It Proclaims to be Tackling (the Same Is True for Rust)
The problem isn't Wayland per se but the false promises and efforts to force everybody to move to it whilst insulting or demonising everyone who won't play along
They Don't Tell Us that 'Digitalisation' (Now Sold as "Hey Hi") Just Means Customers Become Unpaid Staff and Are Made Accountable
People are being conditioned to associate technology with something undesirable, at times even unbearable
Diplomatic Immunity Should Not Exist for Anybody
The EPO in its current form gradually 'normalises' the end of European democracy
Brett Wilson LLP Stopped Sending Me Papers When I Showed It had Sent Me Over 5 Kilograms of Legal Papers
A week ago we lodged our third lawsuit
Microsoft Mass Layoffs and Shutdowns Became the New Normal at Microsoft
Microsoft mass layoffs became a topic of everyday media coverage since May
Amazon Web Services (AWS) Has Layoffs and Microsoft Gaming/Entertainment Division Has an Uncertain Future
it's good to see all those horrible things crashing and burning
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, July 21, 2025
IRC logs for Monday, July 21, 2025
FSF "Raised Almost $139,000 During This Summer Campaign"
"Thank you for making a stand against dystopia!"
Gemini Links 22/07/2025: VPS Exploited and Fear of View
Links for the day