PT-2008-1740 · Microsoft · Sql Server Desktop Engine (Msde) 2000+3

Publicado 2008-07-08 · Atualizado 2019-02-28 · CVE-2008-0085

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SQL Server versions 7.0 SP4, 2000 SP4, 2005 SP1 and SP2 SQL Server 2000 Desktop Engine (MSDE 2000) version SP4 SQL Server 2005 Express Edition versions SP1 and SP2 Microsoft Data Engine (MSDE) version 1.0 SP4

Description An information disclosure issue exists due to improper memory page initialization when reallocating memory. This allows database operators to obtain sensitive information, such as database contents, via unknown vectors related to memory page reuse. An attacker with database operator access could exploit this to access customer data.

Recommendations For SQL Server versions 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, update to a version that properly initializes memory pages. For SQL Server 2000 Desktop Engine (MSDE 2000) version SP4, update to a version that properly initializes memory pages. For SQL Server 2005 Express Edition versions SP1 and SP2, update to a version that properly initializes memory pages. For Microsoft Data Engine (MSDE) version 1.0 SP4, update to a version that properly initializes memory pages. As a temporary workaround, consider restricting access to sensitive database contents until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-0085

Produtos afetados

Data Engine

Sql Server

Sql Server Desktop Engine (Msde) 2000

Sql Server 2005 Express Edition

Referências · 11

• http://us-cert.gov/cas/techalerts/TA08-190A.html · Nota
• http://secunia.com/advisories/30970 · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-040 · Aviso do Fabricante
• http://securitytracker.com/id?1020441 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14213 · Nota
• http://vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html · Nota
• http://vupen.com/english/advisories/2008/2022/references · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0085 · Nota de Segurança
• http://securityfocus.com/archive/1/516397/100/0/threaded · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0085 · Nota de Segurança
• http://vmware.com/security/advisories/VMSA-2011-0003.html · Correção