Unchecked Buffer May Occur When You Connect to Remote Data Source - Released February 20, 2002
When you submit a query to a remote data source and the query has a string longer than what is expected, the buffer could be overwritten. If you submit a query to a remote data source and they query does have a string longer than what is expected, the query may cause a handled exception of the SQL Server thread, or may allow an attacker to run arbitrary code under the security context in which the SQL Server service is running.
Non-Sysadmin User Can Execute xp_cmdshell If SQL Agent Proxy Account Revoked - Released January 29, 2002
After you use SQL Server Enterprise Manager to disable the non-sysadmin Job Step Proxy Account:
Non-sysadmin users can still successfully execute the xp_cmdshell extended stored procedure.
Jobs that use the xp_cmdshell extended stored procedure, which are owned by non-sysadmin users, still successfully execute.
|