Re: COBOL Compiler for Windows

Robert wrote:
> 
> How does a virus get into a database server? You can't send it
executable code. 

Typically, via SQL injection attacks that create stored procedures.

See for example David Litchfield's recent paper on "Lateral SQL 
Injection" attacks against Oracle:

http://www.databasesecurity.com/dbsec/lateral-sql-injection.pdf

In brief: attacker sends data to the system that is incorrectly 
interpreted as SQL, due to incautious handling of tainted data.

This class of vulnerability potentially exists for any database that 
sup****ts any privileged operations over SQL. The hole is actually in 
the application code that processes untrustworthy input and builds SQL 
requests, and in database administration (giving the account used by 
the application excess privilege, for example).

-- 
Michael Wojcik
Micro Focus