ID CVE-2008-0107
Summary Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 allows remote authenticated users to execute arbitrary code via a (1) SMB or (2) WebDAV pathname for an on-disk file (aka stored backup file) with a crafted record size value, which triggers a heap-based buffer overflow, aka "SQL Server Memory Corruption Vulnerability."
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:data_engine:1.0:sp4
    cpe:2.3:a:microsoft:data_engine:1.0:sp4
  • Microsoft SQL Server 7.0 Service Pack 4
    cpe:2.3:a:microsoft:sql_server:7.0:sp4
  • Microsoft SQL Server 2000 Service Pack 4
    cpe:2.3:a:microsoft:sql_server:2000:sp4
  • cpe:2.3:a:microsoft:sql_server:2000:sp4:itanium
    cpe:2.3:a:microsoft:sql_server:2000:sp4:itanium
  • Microsoft SQL Server 2005 Service Pack 1
    cpe:2.3:a:microsoft:sql_server:2005:sp1
  • cpe:2.3:a:microsoft:sql_server:2005:sp1:express
    cpe:2.3:a:microsoft:sql_server:2005:sp1:express
  • cpe:2.3:a:microsoft:sql_server:2005:sp1:itanium
    cpe:2.3:a:microsoft:sql_server:2005:sp1:itanium
  • cpe:2.3:a:microsoft:sql_server:2005:sp1:x64
    cpe:2.3:a:microsoft:sql_server:2005:sp1:x64
  • Microsoft SQL Server 2005 Service Pack 2
    cpe:2.3:a:microsoft:sql_server:2005:sp2
  • cpe:2.3:a:microsoft:sql_server:2005:sp2:express
    cpe:2.3:a:microsoft:sql_server:2005:sp2:express
  • cpe:2.3:a:microsoft:sql_server:2005:sp2:itanium
    cpe:2.3:a:microsoft:sql_server:2005:sp2:itanium
  • cpe:2.3:a:microsoft:sql_server:2005:sp2:x64
    cpe:2.3:a:microsoft:sql_server:2005:sp2:x64
  • cpe:2.3:a:microsoft:sql_server_desktop_engine:2000:sp4
    cpe:2.3:a:microsoft:sql_server_desktop_engine:2000:sp4
  • cpe:2.3:a:microsoft:wmsde:2000
    cpe:2.3:a:microsoft:wmsde:2000
  • cpe:2.3:a:microsoft:wyukon:-:sp2
    cpe:2.3:a:microsoft:wyukon:-:sp2
  • Microsoft Windows 2003 Server Service Pack 1
    cpe:2.3:o:microsoft:windows_2003_server:-:sp1
  • Microsoft Windows 2003 Server Service Pack 2
    cpe:2.3:o:microsoft:windows_2003_server:-:sp2
  • cpe:2.3:a:microsoft:wmsde:2000
    cpe:2.3:a:microsoft:wmsde:2000
  • cpe:2.3:a:microsoft:wyukon:-:sp2:x64
    cpe:2.3:a:microsoft:wyukon:-:sp2:x64
  • Microsoft Windows Server 2003
    cpe:2.3:o:microsoft:windows_server_2003
  • Microsoft Windows Server 2003 Service Pack 2
    cpe:2.3:o:microsoft:windows_server_2003:-:sp2
  • cpe:2.3:a:microsoft:wyukon:-:sp2
    cpe:2.3:a:microsoft:wyukon:-:sp2
  • cpe:2.3:a:microsoft:wyukon:-:sp2:x64
    cpe:2.3:a:microsoft:wyukon:-:sp2:x64
  • cpe:2.3:o:microsoft:windows_server_2008:-:x32
    cpe:2.3:o:microsoft:windows_server_2008:-:x32
  • cpe:2.3:o:microsoft:windows_server_2008:-:x64
    cpe:2.3:o:microsoft:windows_server_2008:-:x64
CVSS
Base: 9.0 (as of 09-07-2008 - 10:18)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family Windows : Microsoft Bulletins
    NASL id SMB_NT_MS08-040.NASL
    description The remote host is running a version of Microsoft SQL Server, Desktop Engine or Internal Database that is vulnerable to multiple memory corruption issues. These vulnerabilities may allow an attacker to gain elevates privileges on the server.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 33444
    published 2008-07-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=33444
    title MS08-040: Vulnerabilities in Microsoft SQL Server Could Allow Elevation of Privilege (941203)
  • NASL family Windows
    NASL id SMB_KB941203.NASL
    description The remote host is running a version of Microsoft SQL Server, Desktop Engine, or Internal Database that is affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to improper initialization of memory pages when reallocating memory. An unauthenticated, remote attacker can exploit this to obtain database contents, resulting in the disclosure of sensitive information. (CVE-2008-0085) - A remote code execution vulnerability exists due to a buffer overflow condition in the convert() function. An authenticated, remote attacker can exploit this, via a crafted SQL expression, to execute arbitrary code. (CVE-2008-0086) - A remote code execution vulnerability exists due to an unspecified buffer overflow condition. An authenticated, remote attacker can exploit this, via a crafted insert statement, to execute arbitrary code. (CVE-2008-0086) - A remote code execution vulnerability exists due to an integer underflow condition. An authenticated, remote attacker can exploit this, via an SMB or WebDAV pathname for an on-disk file with a crafted record size value, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2008-0107)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 34311
    published 2008-09-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=34311
    title MS08-040: Microsoft SQL Server Multiple Privilege Escalation (941203) (uncredentialed check)
  • NASL family VMware ESX Local Security Checks
    NASL id VMWARE_VMSA-2011-0003.NASL
    description a. vCenter Server and vCenter Update Manager update Microsoft SQL Server 2005 Express Edition to Service Pack 3 Microsoft SQL Server 2005 Express Edition (SQL Express) distributed with vCenter Server 4.1 Update 1 and vCenter Update Manager 4.1 Update 1 is upgraded from SQL Express Service Pack 2 to SQL Express Service Pack 3, to address multiple security issues that exist in the earlier releases of Microsoft SQL Express. Customers using other database solutions need not update for these issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086, CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL Express Service Pack 3. b. vCenter Apache Tomcat Management Application Credential Disclosure The Apache Tomcat Manager application configuration file contains logon credentials that can be read by unprivileged local users. The issue is resolved by removing the Manager application in vCenter 4.1 Update 1. If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon credentials are not present in the configuration file after the update. VMware would like to thank Claudio Criscione of Secure Networking for reporting this issue to us. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2010-2928 to this issue. c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version 1.6.0_21 Oracle (Sun) JRE update to version 1.6.0_21, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841, CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845, CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849, CVE-2010-0850. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following name to the security issue fixed in Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886. d. vCenter Update Manager Oracle (Sun) JRE is updated to version 1.5.0_26 Oracle (Sun) JRE update to version 1.5.0_26, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566, CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573, CVE-2010-3565,CVE-2010-3568, CVE-2010-3569, CVE-2009-3555, CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562, CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572, CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541, CVE-2010-3574. e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28 Apache Tomcat updated to version 6.0.28, which addresses multiple security issues that existed in earlier releases of Apache Tomcat The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i and CVE-2009-3548. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157. f. vCenter Server third-party component OpenSSL updated to version 0.9.8n The version of the OpenSSL library in vCenter Server is updated to 0.9.8n. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-0740 and CVE-2010-0433 to the issues addressed in this version of OpenSSL. g. ESX third-party component OpenSSL updated to version 0.9.8p The version of the ESX OpenSSL library is updated to 0.9.8p. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-3864 and CVE-2010-2939 to the issues addressed in this update. h. ESXi third-party component cURL updated The version of cURL library in ESXi is updated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-0734 to the issues addressed in this update. i. ESX third-party component pam_krb5 updated The version of pam_krb5 library is updated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-3825 and CVE-2009-1384 to the issues addressed in the update. j. ESX third-party update for Service Console kernel The Service Console kernel is updated to include kernel version 2.6.18-194.11.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070, CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524, CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308, CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086, CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291, CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437, CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and CVE-2010-3081 to the issues addressed in the update. Notes : - The update also addresses the 64-bit compatibility mode stack pointer underflow issue identified by CVE-2010-3081. This issue was patched in an ESX 4.1 patch prior to the release of ESX 4.1 Update 1 and in a previous ESX 4.0 patch release. - The update also addresses CVE-2010-2240 for ESX 4.0.
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 51971
    published 2011-02-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=51971
    title VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
  • NASL family Misc.
    NASL id VMWARE_VMSA-2011-0003_REMOTE.NASL
    description The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries : - Apache Tomcat - Apache Tomcat Manager - cURL - Java Runtime Environment (JRE) - Kernel - Microsoft SQL Express - OpenSSL - pam_krb5
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 89674
    published 2016-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89674
    title VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)
oval via4
accepted 2013-10-07T04:01:41.259-04:00
class vulnerability
contributors
  • name SecPod Team
    organization SecPod Technologies
  • name Pradeep R B
    organization SecPod Technologies
  • name Dragos Prisaca
    organization Symantec Corporation
  • name Maria Kedovskaya
    organization ALTX-SOFT
definition_extensions
  • comment Microsoft SQL Server 2005 SP2 is installed
    oval oval:org.mitre.oval:def:8397
  • comment Microsoft SQL Server 2005 is installed
    oval oval:org.mitre.oval:def:6082
  • comment Microsoft SQL Server 2005 SP2 is installed
    oval oval:org.mitre.oval:def:8397
  • comment Microsoft SQL Server 2005 is installed
    oval oval:org.mitre.oval:def:6082
description Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 allows remote authenticated users to execute arbitrary code via a (1) SMB or (2) WebDAV pathname for an on-disk file (aka stored backup file) with a crafted record size value, which triggers a heap-based buffer overflow, aka "SQL Server Memory Corruption Vulnerability."
family windows
id oval:org.mitre.oval:def:13936
status accepted
submitted 2011-11-15T14:16:37
title Memory Corruption Vulnerability in SQL Server
version 15
refmap via4
bid 30119
bugtraq
  • 20080708 Re: [Full-disclosure] iDefense Security Advisory 07.08.08: Microsoft SQL Server Restore Integer Underflow Vulnerability
  • 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
cert TA08-190A
confirm
idefense 20080708 Microsoft SQL Server Restore Integer Underflow Vulnerability
misc http://www.insomniasec.com/advisories/ISVA-080709.1.htm
ms MS08-040
sectrack 1020441
secunia 30970
vupen ADV-2008-2022
Last major update 26-01-2012 - 22:21
Published 08-07-2008 - 19:41
Last modified 26-02-2019 - 09:04
Back to Top