Microsoft KB Archive/818388

= FIX: A Transact-SQL Statement That Is Embedded in the Database Name Runs with System Administrator Permissions =

Article ID: 818388

Article Last Modified on 11/2/2007

-

APPLIES TO


 * Microsoft SQL Server 2000 Developer Edition
 * Microsoft SQL Server 2000 Standard Edition
 * Microsoft SQL Server 2000 Enterprise Edition
 * Microsoft SQL Server 2000 Personal Edition
 * Microsoft SQL Server 2000 Enterprise Edition
 * Microsoft SQL Server 2000 Workgroup Edition
 * Microsoft SQL Server 2000 Desktop Engine (Windows)
 * Microsoft SQL Server 2000 Developer Edition
 * Microsoft SQL Server 2000 Enterprise Edition 64-bit

-



BUG # : 469140 (SQL Server 8.0)



SYMPTOMS
When you create a database that has a Transact-SQL statement embedded in the database name, the Transact-SQL statement runs with System Administrator permissions when a SQL Profiler user tries to save the trace file as a trace table in the same instance of SQL Server 2000.



Service pack information
To resolve this problem, obtain the latest service pack for Microsoft SQL Server 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

290211 How to obtain the latest SQL Server 2000 service pack

Hotfix information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.   Date         Time   Version             Size   File name --  06-May-2003  03:16  2000.80.818.0      78,400  Console.exe 08-May-2003 04:18  2000.80.818.0      29,244  Dbmslpcn.dll 25-Apr-2003 02:12                    786,432  Distmdl.ldf 25-Apr-2003 02:12                  2,359,296  Distmdl.mdf 30-Jan-2003 01:55                        180  Drop_repl_hotfix.sql 07-Apr-2003 19:15  2000.80.801.0   1,557,052  Dtsui.dll 24-Apr-2003 02:51                    747,927  Instdist.sql 03-May-2003 01:56                      1,581  Inst_repl_hotfix.sql 08-Feb-2003 06:40  2000.80.765.0      90,692  Msgprox.dll 01-Apr-2003 02:07                      1,873  Odsole.sql 05-Apr-2003 01:46  2000.80.800.0      62,024  Odsole70.dll 02-Apr-2003 21:48  2000.80.796.0      57,904  Osql.exe 02-Apr-2003 23:15  2000.80.797.0     279,104  Pfutil80.dll 04-Apr-2003 21:27                  1,083,467  Replmerg.sql 04-Apr-2003 21:53  2000.80.798.0     221,768  Replprov.dll 08-Feb-2003 06:40  2000.80.765.0     307,784  Replrec.dll 05-May-2003 00:05                  1,085,874  Replsys.sql 08-May-2003 04:18  2000.80.818.0     492,096  Semobj.dll 05-May-2003 00:24  2000.80.818.0     172,032  Semobj.rll 16-Apr-2003 22:39                    115,892  Sp3_serv_uni.sql 08-May-2003 04:18  2000.80.818.0   4,215,360  Sqldmo.dll 07-Apr-2003 17:44                     25,172  Sqldumper.exe 19-Mar-2003 18:20  2000.80.789.0      28,672  Sqlevn70.rll 24-Apr-2003 05:39  2000.80.811.0     176,696  Sqlmap70.dll 08-Feb-2003 06:40  2000.80.765.0      57,920  Sqlrepss.dll 08-May-2003 04:19  2000.80.818.0   7,540,817  Sqlservr.exe 08-May-2003 04:19                 12,731,392  Sqlservr.pdb 08-Feb-2003 06:40  2000.80.765.0      45,644  Sqlvdi.dll 08-May-2003 04:18  2000.80.818.0      29,244  Ssmslpcn.dll 08-May-2003 04:18  2000.80.818.0      82,492  Ssnetlib.dll 08-May-2003 04:18  2000.80.818.0      25,148  Ssnmpn70.dll 08-May-2003 04:18  2000.80.818.0     158,240  Svrnetcn.dll 05-May-2003 00:09  2000.80.818.0      76,416  Svrnetcn.exe 30-Apr-2003 23:52  2000.80.816.0      45,132  Ums.dll 30-Apr-2003 23:52                    132,096  Ums.pdb 28-Feb-2003 01:34  2000.80.778.0      98,872  Xpweb70.dll Note Because of file dependencies, the most recent hotfix or feature that contains these files may also contain additional files.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section.This problem was first corrected in Microsoft SQL Server 2000 Service Pack 4.



MORE INFORMATION
Although a user in the Database Creator fixed server role does not have System Administrator permissions, a Transact-SQL statement that the user creates may run with System Administrator permissions. This problem may occur when the user creates a database and embeds the Transact-SQL statement in the database name. When a SQL Profiler user starts a trace and saves the trace file as a trace table, the Destination Table dialog box initializes with the names of all the databases that are available at the instance of SQL Server 2000. The code that is embedded in the database name runs with System Administrator permissions during this initialization.

Keywords: kbbug kbfix kbtsql kbqfe kbsqlserv2000presp4fix KB818388

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.