Even though Service Pack 1 for SQL Server 2012 was released almost 2 months ago, it’s only now that I’ve had a chance to check if the FileTable security flaw was addressed. And I am pleased to report that the problem was resolved with the release of Service Pack 1, so that is good news for implementations that require read-only access for some users and read-write access for others. I won’t restate the entire problem here; the link above is to my original blog post where I detailed the issue. It’s also interesting to note that the Service Pack 1 list of included fixes does not mention this flaw.
After Service Pack 1 has been applied, a user with only SELECT permission on the FileTable will still be open to open files as before. It appears though that the client software does not know that the access is read-only. Notepad, for example, when trying to save a file will not just show the Save As dialog box (as it usually does when trying to save a read-only file), but will first display an error dialog:
This error is misleading, as there is no problem accessing the file share. Then, as expected, the Save As dialog will appear. Not every application exhibits this problem though.
CAUTION: At this point, there is no Cumulative Update (CU) for RTM that includes this fix. Cumulative Update 5 for SQL Server 2012 RTM was released after SP 1, however, that build is still vulnerable.
Sven Aelterman 