Microsoft fixes remote code exec bug in Azure database connector

By

Amazon Redshift ODBC connector found vulnerable.

Microsoft says it has mitigated and remediated three vulnerabilities that could have been used to run commands remotely across the Azure cloud Integration Runtimes (IR) compute infrastructure.

Microsoft fixes remote code exec bug in Azure database connector

IR is used by the Azure Data Factory and Synapse pipelines, and provides several data integration capabilities across different network environments.

In its advisory, Microsoft said a vulnerability in a third-party Open Database Connectivity (ODBC) driver used to connect to Amazon Redshift was found to be vulnerable to remote code execution.

The ODBC connector is used in Azure Synapse Pipelines and Data Factory IR.

Attackers exploiting the vulnerability could have acquired the Azure Data Factory service certificate and run commands in other cloud tenants' Data Factory IRs.

While an attacker could have run commands remotely across IR infrastructure without being limited to a single tenant, the vulnerability did not affect Azure Synapse as a whole.

Microsoft implemented several mitigations against the bug, including reviewing the third-party ODBC driver code, working with Amazon on the fixes.

Security vendor Orca reported the bug to Microsoft on January 4, and a fix was rolled out on April 15 United States time.

Microsoft said it is not aware of the vulnerability being exploited.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

Log In

  |  Forgot your password?