Microsoft Data Access Components (MDAC) is a collection of components that is used to provide database connectivity on Microsoft Windows operating systems. MDAC is a ubiquitous technology, and it is likely to be present on most Windows systems.
By default, MDAC is included as part of Microsoft Windows XP, Microsoft Windows 2000, and Microsoft Windows Millennium Edition (Me). A number of other products and technologies also include or install MDAC. For example, the Microsoft Windows NT 4.0 Option Pack and Microsoft SQL Server 2000 both include MDAC, and some MDAC components are present as part of Microsoft Internet Explorer even if MDAC itself is not installed. MDAC is also available as a stand-alone technology. To download MDAC, visit the following Microsoft Web site:
MDAC provides the underlying functionality for a number of database operations, such as connecting to remote databases and returning data to a client. Specifically, it is the MDAC component known as Open Database Connectivity (ODBC) that provides this functionality.
A security vulnerability results because one of the ODBC functions in MDAC that is used to connect to data sources contains an unchecked buffer. An attacker can seek to exploit the vulnerability by constructing a Web page that, when visited by the user, can execute code of the attacker's choice with the credentials of the user. The Web page can be hosted on a Web site or sent directly to the user in an e-mail message.
In the case of a system that is running SQL Server, an attacker can seek to exploit this vulnerability by using the Transact-SQL OpenRowSet command. An attacker who submits a database query that contains a specially-malformed parameter in a call to OpenRowSet might overrun the buffer, either to cause the computer that is running SQL Server to fail, or to cause the computer that is running SQL Server to take actions that are dictated by the attacker.
The mitigating factors are as follows:
- Users who read e-mail messages as plain text must take an action before an attacker can exploit the vulnerability.
- Systems that are configured to disable active scripting in Internet Explorer are not affected by this vulnerability.
- In the Web-based attack scenario, a user must visit a malicious Web site that is under the control of an attacker. An attacker cannot force users to visit a malicious Web site outside the HTML e-mail vector. Instead, an attacker must lure users to the Web site, typically by getting the user to click a link that takes them to the Web site of the attacker.
- The credentials that are gained through a successful attack would be equal to those of the application under which ODBC is running. Most of the time, an attacker gains only the same level of credentials that the user logged in with.
- By default, Outlook Express 6.0 and Outlook 2002 open HTML mail in the Restricted Sites Zone. Additionally, Outlook 98 and 2000 open HTML mail in the Restricted Sites Zone if the Outlook Email Security Update has been installed. Customers who use any of these products would be at no risk from an e-mail borne attack that tried to exploit this vulnerability unless the user clicked a malicious link in the e-mail.