PT-2008-1761 · Microsoft · Sql Server 2005 Sp2+4

Published 2008-07-08 · Updated 2018-10-15 · CVE-2008-0106

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2005 SP1 Microsoft SQL Server 2005 SP2 Microsoft SQL Server 2005 Express Edition SP1 Microsoft SQL Server 2005 Express Edition SP2

Description A buffer overflow issue exists, allowing remote authenticated users to execute arbitrary code via a crafted insert statement. This could enable an authenticated attacker to gain elevation of privilege, potentially running code and taking complete control of the system.

Recommendations For Microsoft SQL Server 2005 SP1, update to a version that includes the fix for this issue. For Microsoft SQL Server 2005 SP2, update to a version that includes the fix for this issue. For Microsoft SQL Server 2005 Express Edition SP1, update to a version that includes the fix for this issue. For Microsoft SQL Server 2005 Express Edition SP2, update to a version that includes the fix for this issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-0106

Affected Products

Sql Server 2005 Express Edition Sp1

Sql Server 2005 Express Edition Sp2

Sql Server 2005 Sp1

Sql Server 2005 Sp2

Sql Server

References · 12

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0106 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0106 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13785 · Note
• http://us-cert.gov/cas/techalerts/TA08-190A.html · Note
• http://vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html · Note
• http://vupen.com/english/advisories/2008/2022/references · Note
• http://securityfocus.com/archive/1/516397/100/0/threaded · Note
• http://secunia.com/advisories/30970 · Note
• http://securitytracker.com/id?1020441 · Note
• http://vmware.com/security/advisories/VMSA-2011-0003.html · Note
• http://securityfocus.com/archive/1/494082/100/0/threaded · Note