PT-2008-6533 · Microsoft · Sql Server 2000+5

Guido Landi · Published 2008-12-10 · Updated 2018-10-12 · CVE-2008-5416

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2000 versions 8.00.2039 through 8.00.2050 Microsoft SQL Server 2005 version 9.00.1399.06 Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) version SP4 Microsoft SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 versions SP1 through SP2 Windows Internal Database (WYukon) version SP2

Description A remote code execution issue exists due to the way SQL Server checks parameters in the sp replwritetovarbin extended stored procedure. This could allow an attacker to execute arbitrary code if they have access to an affected system or if a SQL injection vulnerability exists. An attacker who successfully exploits this issue could gain complete control of the system, allowing them to install programs, view, change, or delete data, or create new accounts.

Recommendations For Microsoft SQL Server 2000 versions 8.00.2039 through 8.00.2050, update to a version that includes the fix for this issue. For Microsoft SQL Server 2005 version 9.00.1399.06, update to a version that includes the fix for this issue. For Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) version SP4, update to a version that includes the fix for this issue. For Microsoft SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 versions SP1 through SP2, update to a version that includes the fix for this issue. For Windows Internal Database (WYukon) version SP2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the sp replwritetovarbin extended stored procedure until a patch is available.

Exploit

Fix

DoS

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-5416

Affected Products

Sql Server 2000

Sql Server Desktop Engine (Msde) 2000

Sql Server 2005

Sql Server

Windows Internal Database

Windows Server 2003

References · 30

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin_sqli.rb · Exploit
• 🔥 https://github.com/SECFORCE/CVE-2008-5416 · Exploit
• 🔥 http://sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt · Exploit
• 🔥 https://exploit-db.com/exploits/16392 · Exploit
• 🔥 https://exploit-db.com/exploits/16396 · Exploit
• 🔥 http://securityfocus.com/bid/32710 · Exploit
• 🔥 https://exploit-db.com/exploits/7501 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5416 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5416 · Security Note
• http://secunia.com/advisories/33034 · Vendor Advisory
• http://securitytracker.com/id?1021490 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.html · Note
• http://securityfocus.com/archive/1/516397/100/0/threaded · Note