{"id": "CVE-2008-4110", "bulletinFamily": "NVD", "title": "CVE-2008-4110", "description": "Buffer overflow in the SQLVDIRLib.SQLVDirControl ActiveX control in Tools\\Binn\\sqlvdir.dll in Microsoft SQL Server 2000 (aka SQL Server 8.0) allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a long URL in the second argument to the Connect method. NOTE: this issue is not a vulnerability in many environments, since the control is not marked as safe for scripting and would not execute with default Internet Explorer settings.", "published": "2008-09-16T18:00:00", "modified": "2018-10-11T16:50:54", "cvss": {"score": 7.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4110", "reporter": "NVD", "references": ["http://securityreason.com/securityalert/4262", "http://www.securityfocus.com/bid/31129", "https://exchange.xforce.ibmcloud.com/vulnerabilities/45186", "http://www.securityfocus.com/archive/1/496232/100/0/threaded"], "cvelist": ["CVE-2008-4110"], "type": "cve", "lastseen": "2018-10-12T11:33:47", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sql_server:2000"], "cvelist": ["CVE-2008-4110"], "cvss": {"score": 7.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "Buffer overflow in the SQLVDIRLib.SQLVDirControl ActiveX control in Tools\\Binn\\sqlvdir.dll in Microsoft SQL Server 2000 (aka SQL Server 8.0) allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a long URL in the second argument to the Connect method. NOTE: this issue is not a vulnerability in many environments, since the control is not marked as safe for scripting and would not execute with default Internet Explorer settings.", "edition": 1, "enchantments": {}, "hash": "b2a2fb5c7947df9b43e8c92e821952712b890423ad07e00714dee0b0879460f6", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "cb5e04b037569ca276093ce8de4219e4", "key": "title"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "84be7a5823901c8b58dc12d1f67315a3", "key": "href"}, {"hash": "6053cb23181916d06b14e7fa7ac2321b", "key": "description"}, {"hash": "774fce555a963c00be305187dd6dff95", "key": "cvss"}, {"hash": "5f116104c3b91ad1ea2c9425ad7ecd34", "key": "cpe"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "6f11e2f3d6f12d570df1026101462711", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "d4807831f3f64a12493717bc08e24588", "key": "modified"}, {"hash": "a3d3097974125dae096829d469d3b9c8", "key": "published"}, {"hash": "27f9e07d5c189ae3c02b17ee1df88a44", "key": "references"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4110", "id": "CVE-2008-4110", "lastseen": "2016-09-03T11:02:21", "modified": "2009-04-04T01:34:52", "objectVersion": "1.2", "published": "2008-09-16T18:00:00", "references": ["http://securityreason.com/securityalert/4262", "http://www.securityfocus.com/bid/31129", "http://www.securityfocus.com/archive/1/archive/1/496232/100/0/threaded", "http://xforce.iss.net/xforce/xfdb/45186"], "reporter": "NVD", "scanner": [], "title": "CVE-2008-4110", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T11:02:21"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sql_server:2000"], "cvelist": ["CVE-2008-4110"], "cvss": {"score": 7.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "Buffer overflow in the SQLVDIRLib.SQLVDirControl ActiveX control in Tools\\Binn\\sqlvdir.dll in Microsoft SQL Server 2000 (aka SQL Server 8.0) allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a long URL in the second argument to the Connect method. NOTE: this issue is not a vulnerability in many environments, since the control is not marked as safe for scripting and would not execute with default Internet Explorer settings.", "edition": 2, "enchantments": {"score": {"modified": "2017-08-08T11:24:54", "value": 7.5, "vector": "NONE"}}, "hash": "910470bd3ebcea7241fe7cadb94c392bff4fc2cdf6f39d8a9e9a9d858fe28341", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "cb5e04b037569ca276093ce8de4219e4", "key": "title"}, {"hash": "26339c82ae00b525457306571bf01080", "key": "references"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "84be7a5823901c8b58dc12d1f67315a3", "key": "href"}, {"hash": "6053cb23181916d06b14e7fa7ac2321b", "key": "description"}, {"hash": "774fce555a963c00be305187dd6dff95", "key": "cvss"}, {"hash": "5f116104c3b91ad1ea2c9425ad7ecd34", "key": "cpe"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "6f11e2f3d6f12d570df1026101462711", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "f49f7ceb7673efd18095ef2e9359acf4", "key": "modified"}, {"hash": "a3d3097974125dae096829d469d3b9c8", "key": "published"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4110", "id": "CVE-2008-4110", "lastseen": "2017-08-08T11:24:54", "modified": "2017-08-07T21:32:25", "objectVersion": "1.3", "published": "2008-09-16T18:00:00", "references": ["http://securityreason.com/securityalert/4262", "http://www.securityfocus.com/bid/31129", "https://exchange.xforce.ibmcloud.com/vulnerabilities/45186", "http://www.securityfocus.com/archive/1/archive/1/496232/100/0/threaded"], "reporter": "NVD", "scanner": [], "title": "CVE-2008-4110", "type": "cve", "viewCount": 1}, "differentElements": ["references", "modified"], "edition": 2, "lastseen": "2017-08-08T11:24:54"}], "edition": 3, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "5f116104c3b91ad1ea2c9425ad7ecd34"}, {"key": "cvelist", "hash": "6f11e2f3d6f12d570df1026101462711"}, {"key": "cvss", "hash": "774fce555a963c00be305187dd6dff95"}, {"key": "description", "hash": "6053cb23181916d06b14e7fa7ac2321b"}, {"key": "href", "hash": "84be7a5823901c8b58dc12d1f67315a3"}, {"key": "modified", "hash": "9f5f9d39a51ff60126462d260790a2fe"}, {"key": "published", "hash": "a3d3097974125dae096829d469d3b9c8"}, {"key": "references", "hash": "ce026553189d31832d1163d86e228678"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "cb5e04b037569ca276093ce8de4219e4"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "4ce3697f4c2a1eb79e62b70cb7a0d21937d5bf755ade463d0c95e3e7c05e38e7", "viewCount": 1, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2018-10-12T11:33:47"}, "dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:1361412562310900125", "OPENVAS:900125"]}], "modified": "2018-10-12T11:33:47"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:microsoft:sql_server:2000"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"openvas": [{"lastseen": "2018-11-30T21:33:53", "bulletinFamily": "scanner", "description": "The host is running Microsoft SQL Server, which is prone to\n buffer-overflow vulnerability.", "modified": "2018-11-30T00:00:00", "published": "2008-12-02T00:00:00", "id": "OPENVAS:1361412562310900125", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310900125", "title": "Microsoft SQL Server 2000 sqlvdir.dll ActiveX Buffer Overflow Vulnerability", "type": "openvas", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_ms_sql_server_2000_activex_bof_vuln_900125.nasl 12602 2018-11-30 14:36:58Z cfischer $\n# Description: Microsoft SQL Server 2000 sqlvdir.dll ActiveX Buffer Overflow Vulnerability\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2008 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n##############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.900125\");\n script_version(\"$Revision: 12602 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-30 15:36:58 +0100 (Fri, 30 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2008-12-02 11:52:55 +0100 (Tue, 02 Dec 2008)\");\n script_cve_id(\"CVE-2008-4110\");\n script_bugtraq_id(31129);\n script_copyright(\"Copyright (C) 2008 SecPod\");\n script_tag(name:\"cvss_base\", value:\"7.6\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:H/Au:N/C:C/I:C/A:C\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Denial of Service\");\n script_name(\"Microsoft SQL Server 2000 sqlvdir.dll ActiveX Buffer Overflow Vulnerability\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_mandatory_keys(\"SMB/WindowsVersion\");\n script_require_ports(139, 445);\n\n script_xref(name:\"URL\", value:\"http://support.microsoft.com/kb/240797\");\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/archive/1/496232\");\n script_xref(name:\"URL\", value:\"http://www.juniper.net/security/auto/vulnerabilities/vuln31129.html\");\n\n script_tag(name:\"summary\", value:\"The host is running Microsoft SQL Server, which is prone to\n buffer-overflow vulnerability.\");\n\n script_tag(name:\"insight\", value:\"Applications sqlvdir.dll ActiveX control is prone to a buffer-overflow\n vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently\n sized buffer. The issue occurs when excessive amounts of data to the Control() method is passed.\");\n\n script_tag(name:\"affected\", value:\"Microsoft SQL Server 2000 SP4 and prior on Windows (all)\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the disclosure of this vulnerability.\n Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the\n product or replace the product by another one.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation allows remote attackers to execute\n arbitrary code and failed attepts causes denial-of-service conditions.\");\n\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"version_func.inc\");\n\nkey = \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft SQL Server 2000\";\nif(!registry_key_exists(key:key)){\n exit(0);\n}\n\nmsSqlVer = registry_get_sz(key:key, item:\"DisplayVersion\");\nif(!msSqlVer) exit(0);\n\nif(egrep(pattern:\"^([0-7]\\..*|8\\.(0?0(\\.([0-9]?[0-9]|1[0-8][0-9]|19[0-4]))?))$\", string:msSqlVer)){\n report = report_fixed_ver(installed_version:msSqlVer, fixed_version:\"WillNotFix\");\n security_message(port:0, data:report);\n exit(0);\n}\n\nexit(99);", "cvss": {"score": 7.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-02T21:10:18", "bulletinFamily": "scanner", "description": "The host is running Microsoft SQL Server, which is prone to\n buffer-overflow vulnerability.", "modified": "2017-02-20T00:00:00", "published": "2008-12-02T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=900125", "id": "OPENVAS:900125", "title": "Microsoft SQL Server 2000 sqlvdir.dll ActiveX Buffer Overflow Vulnerability", "type": "openvas", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_ms_sql_server_2000_activex_bof_vuln_900125.nasl 5370 2017-02-20 15:24:26Z cfi $\n# Description: Microsoft SQL Server 2000 sqlvdir.dll ActiveX Buffer Overflow Vulnerability\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2008 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n##############################################################################\n\ntag_impact = \"Successful exploitation allows remote attackers to execute\n arbitrary code and failed attepts causes denial-of-service conditions.\n Impact Level : Application\";\n\ntag_solution = \"No solution or patch was made available for at least one year\nsince disclosure of this vulnerability. Likely none will be provided anymore.\nGeneral solution options are to upgrade to a newer release, disable respective\nfeatures, remove the product or replace the product by another one.\nFor updates refer http://www.microsoft.com/sqlserver\";\n\ntag_affected = \"Microsoft SQL Server 2000 SP4 and prior on Windows (all)\";\n\ntag_insight = \"Applications sqlvdir.dll ActiveX control is prone to a buffer-overflow\n vulnerability because it fails to bounds-check user-supplied data\n before copying it into an insufficiently sized buffer. The issue occurs\n when excessive amounts of data to the Control() method is passed.\";\n\n\ntag_summary = \"The host is running Microsoft SQL Server, which is prone to\n buffer-overflow vulnerability.\";\n\n\nif(description)\n{\n script_id(900125);\n script_version(\"$Revision: 5370 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-02-20 16:24:26 +0100 (Mon, 20 Feb 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-12-02 11:52:55 +0100 (Tue, 02 Dec 2008)\");\n script_cve_id(\"CVE-2008-4110\");\n script_bugtraq_id(31129);\n script_copyright(\"Copyright (C) 2008 SecPod\");\n script_tag(name:\"cvss_base\", value:\"7.6\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:H/Au:N/C:C/I:C/A:C\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Denial of Service\");\n script_name(\"Microsoft SQL Server 2000 sqlvdir.dll ActiveX Buffer Overflow Vulnerability\");\n\n script_dependencies(\"secpod_reg_enum.nasl\");\n script_mandatory_keys(\"SMB/WindowsVersion\");\n script_require_ports(139, 445);\n script_xref(name : \"URL\" , value : \"http://support.microsoft.com/kb/240797\");\n script_xref(name : \"URL\" , value : \"http://www.securityfocus.com/archive/1/496232\");\n script_xref(name : \"URL\" , value : \"http://www.juniper.net/security/auto/vulnerabilities/vuln31129.html\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n exit(0);\n}\n\n\n include(\"smb_nt.inc\");\n\n msSqlPort = 1433;\n\n if(!get_port_state(msSqlPort)){\n exit(0);\n }\n\n if(!get_kb_item(\"SMB/WindowsVersion\")){\n exit(0);\n }\n\n msSqlVer = registry_get_sz( key:\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\" +\n \"\\Uninstall\\Microsoft SQL Server 2000\",\n item:\"DisplayVersion\");\n\n if(egrep(pattern:\"^([0-7]\\..*|8\\.(0?0(\\.([0-9]?[0-9]|1[0-8][0-9]|19[0-4]))?\" +\n \"))$\", string:msSqlVer)){\n security_message(0);\n }\n", "cvss": {"score": 7.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}