CERT-In Vulnerability Note
CIVN-2008-0192
Microsoft SQL Server sp_replwritetovarbin limited memory overwrite vulnerability
Original Issue Date:December 18, 2008
Updated: May 30, 2010
Severity Rating: HIGH
Systems Affected
- SQL Server 2000 Service Pack 4
- SQL Server 2000 Itanium-based Edition Service Pack 4
- SQL Server 2005 Service Pack 2
- SQL Server 2005 x64 Edition Service Pack 2
- SQL Server 2005 with SP2 for Itanium-based Systems
- Microsoft SQL Server 2000 Desktop Engine MSDE 2000 Service Pack 4
- SQL Server 2005 Express Edition Service Pack 2
Component Affected
- Microsoft SQL Server 2000 Desktop Engine WMSDE
- Windows Internal Database WYukon Service Pack 2
- Windows Internal Database WYukon x64 Edition Service
Pack 2
Overview
A vulnerability has been reported in sp_replwritetovarbin extended stored procedure in Microsoft SQL server, which could be exploited by a remote user with a direct database connection, or via SQL injection in a vulnerable web application to cause a denial of service or execute arbitrary code.
Description
A heap-based buffer overflow vulnerability exists in the sp_replwritetovarbin extended stored procedure in Microsoft SQL Server .
A remote attacker could exploit this vulnerability by supplying specially crafted parameters to the sp_replwritetovarbin extended stored procedure to overwrite memory and potentially execute arbitrary code on the target system and completely compromise affected computers. Failed attacks will likely cause denial-of-service conditions.
Workaround
Deny permissions on the sp_replwritetovarbin extended stored procedure.
For details, refer to Microsoft Security Advisory 961040
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS09-004
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms09-004.mspx
http://www.microsoft.com/technet/security/advisory/961040.mspx
References
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms09-004.mspx
http://www.microsoft.com/technet/security/advisory/961040.mspx
SEC Consult
http://www.sec-consult.com/files/20081209_mssql-2000
SecurityFocus
http://www.securityfocus.com/bid/32710
Security Database
http://www.security-database.com/detail.php?alert=CVE-2008-5416
Secunia
http://secunia.com/advisories/33034
SecurityTracker
http://securitytracker.com/id?1021363
CVE Name
CVE-2008-5416
CVE-2008-4270
CWE Name
CWE-119
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|