I'm new at this whole DBA thing, so maybe this is totally standard practice.But we have a software vendor that wants remote access to our SQL server at an admin level to setup and install software ...

The software giant yesterday issued a security advisory outlining a flaw that could allow remote code execution on many versions of SQL Server.