Microsoft SQL Server fails to properly validate parameters to the sp_replwritetovarbin extended stored procedure

🗓️ 24 Dec 2008 00:00:00Reported by CERTType

cert

cert🔗 www.kb.cert.org👁 39 Views

Microsoft SQL Server sp_replwritetovarbin validation vulnerabilit

Reporter	Title	Published	Views	Family All 33
Tenable Nessus	Microsoft SQL Server RCE (959420)	11 Feb 200900:00	–	nessus
Tenable Nessus	MS09-004: Vulnerability in Microsoft SQL Server Could Allow Remote Code Execution (959420) (uncredentialed check)	11 Feb 200900:00	–	nessus
Tenable Nessus	MS09-004: Vulnerability in Microsoft SQL Server Could Allow Remote Code Execution (959420)	11 Feb 200900:00	–	nessus
Tenable Nessus	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	14 Feb 201100:00	–	nessus
Tenable Nessus	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)	4 Mar 201600:00	–	nessus
ATTACKERKB	CVE-2008-5416	10 Dec 200814:00	–	attackerkb
Circl	CVE-2008-5416	17 Dec 200800:00	–	circl
Check Point Advisories	MS-SQL Server Sp_replwritetovarbin Stored Procedure Buffer Overflow (CVE-2008-5416)	16 Dec 200800:00	–	checkpoint_advisories
Check Point Advisories	Preemptive Protection against Microsoft SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability (MS09-004)	10 Feb 200900:00	–	checkpoint_advisories
CVE	CVE-2008-5416	10 Dec 200813:33	–	cve

Source	Link
sec-consult	www.sec-consult.com/files/20081209_mssql-sp_replwritetovarbin_memwrite.txt
milw0rm	www.milw0rm.com/exploits/7501
microsoft	www.microsoft.com/technet/security/advisory/961040.mspx
msdn	www.msdn.microsoft.com/en-us/library/aa215995(SQL.80).aspx
msdn	www.msdn.microsoft.com/en-us/library/aa933290(SQL.80).aspx
microsoft	www.microsoft.com/technet/security/advisory/954462.mspx
microsoft	www.microsoft.com/technet/security/bulletin/ms09-004.mspx

11 Feb 2009 03:09Current

9.1High risk

Vulners AI Score9.1

CVSS 29

EPSS0.87901

microsoft sql server sp_replwritetovarbin authentication arbitrary code execution sql injection microsoft security bulletin sec consult security update deny execute permissions remove extended stored procedure vendor statement cvss metrics cve-2008-5416 sec consult vulnerability lab