OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Hall, Philip (phall_at_SPSS.COM)
Date: Thu Jul 11 2002 - 22:32:27 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Did I say 'and' ? Of course, as you pointed out, it should have been 'or'

    --phil

    > You only need to be granted the bulkadmin fixed server role to execute
    > BULK INSERT. You do NOT need to have sysadmin to execute BULK INSERT
    > (yes, I have tested this several times).
    >
    > So this vulnerability leads to a privilege escalation.
    >
    > -----Original Message-----
    >
    > > To be able to use the 'BULK INSERT' query one must have the
    > > privileges of the database owner or dbo. Note this does not
    > > necessarily imply 'sa' equivalence.
    >
    > In fact, you need to be a member of the sysadmin and bulkadmin fixed
    > server roles to be able to execute BULK INSERT, both of these
    > have to be explicitly set, if you're not user 'sa'