PT-2008-1740 · Microsoft · Sql Server Desktop Engine (Msde) 2000+3

Published 2008-07-08 · Updated 2019-02-28 · CVE-2008-0085

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SQL Server versions 7.0 SP4, 2000 SP4, 2005 SP1 and SP2 SQL Server 2000 Desktop Engine (MSDE 2000) version SP4 SQL Server 2005 Express Edition versions SP1 and SP2 Microsoft Data Engine (MSDE) version 1.0 SP4

Description An information disclosure issue exists due to improper memory page initialization when reallocating memory. This allows database operators to obtain sensitive information, such as database contents, via unknown vectors related to memory page reuse. An attacker with database operator access could exploit this to access customer data.

Recommendations For SQL Server versions 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, update to a version that properly initializes memory pages. For SQL Server 2000 Desktop Engine (MSDE 2000) version SP4, update to a version that properly initializes memory pages. For SQL Server 2005 Express Edition versions SP1 and SP2, update to a version that properly initializes memory pages. For Microsoft Data Engine (MSDE) version 1.0 SP4, update to a version that properly initializes memory pages. As a temporary workaround, consider restricting access to sensitive database contents until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-0085

Affected Products

Data Engine

Sql Server

Sql Server Desktop Engine (Msde) 2000

Sql Server 2005 Express Edition

References · 11

• http://secunia.com/advisories/30970 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0085 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0085 · Security Note
• http://vmware.com/security/advisories/VMSA-2011-0003.html · Patch
• http://us-cert.gov/cas/techalerts/TA08-190A.html · Note
• http://securitytracker.com/id?1020441 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14213 · Note
• http://vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html · Note
• http://vupen.com/english/advisories/2008/2022/references · Note
• http://securityfocus.com/archive/1/516397/100/0/threaded · Note