Microsoft SQL Server text message query buffer overflow
| mssql-text-message-bo (7724) |  High Risk |
Description:
Microsoft SQL Server is vulnerable to a denial of service attack caused by a buffer overflow in the functions that are used to create and display text messages. By creating and executing a specially-crafted query that calls one of the affected functions, the attacker could overflow a buffer and execute arbitrary code on the system with privileges of the SQL Server process or cause the service to fail.
Consequences:
Gain Privileges
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin. See References.
For Microsoft SQL Server 7.0:
Microsoft originally provided a patch for this vulnerability in MS01-060, MS02-007, MS02-020, MS02-043, MS02-056, and MS02-061, but they were superseded by the patch released with MS03-031.
For Microsoft SQL Server 2000:
Microsoft originally provided a patch for this vulnerability in MS01-060, MS02-007, MS02-020, MS02-034, MS02-038, MS02-039, MS02-043, MS02-056, and MS02-061, but they were superseded by the patch released with MS03-031.
References:
- @stake, Inc. Security Advisory A122001-1: Multiple overflow and format string vulnerabilities in Microsoft SQL Server.
- CERT Advisory CA-2002-22: Multiple Vulnerabilities in Microsoft SQL Server.
- Microsoft Knowledge Base Article 305601: MS01-060: FIX: CRT String Format Functions May Underwrite Buffer.
- Microsoft Security Bulletin MS01-060: SQL Server Text Formatting Functions Contain Unchecked Buffers.
- Microsoft Security Bulletin MS02-007: SQL Server Remote Data Source Function Contain Unchecked Buffers.
- Microsoft Security Bulletin MS02-020: SQL Extended Procedure Functions Contain Unchecked Buffers (Q319507).
- Microsoft Security Bulletin MS02-034: Cumulative Patch for SQL Server (Q316333).
- Microsoft Security Bulletin MS02-038: Unchecked Buffer in SQL Server 2000 Utilities Could Allow Code Execution (Q316333).
- Microsoft Security Bulletin MS02-039: Buffer Overruns in SQL Server 2000 Resolution Service Could Enable Code Execution (Q323875).
- Microsoft Security Bulletin MS02-043: Cumulative Patch for SQL Server (Q316333).
- Microsoft Security Bulletin MS02-056: Cumulative Patch for SQL Server (Q316333).
- Microsoft Security Bulletin MS02-061: Elevation of Privilege in SQL Server Web Tasks (Q316333).
- Microsoft Security Bulletin MS03-031: Cumulative Patch for Microsoft SQL Server (815495).
- BID-3733: Microsoft SQL-Server Buffer Overflow Vulnerability
- CVE-2001-0542: Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror, (2) formatmessage, or (3) xp_sprintf. NOTE: the C runtime format string vulnerability reported in MS01-060 is identified by CVE-2001-0879.
- OSVDB ID: 10144: Microsoft SQL Server raiserror Function Overflow
- OSVDB ID: 10145: Microsoft SQL Server formatmessage Function Overflow
- OSVDB ID: 10146: Microsoft SQL Server xp_sprintf Function Overflow
- OSVDB ID: 10166: Microsoft SQL Server raiserror Function DoS
- OSVDB ID: 10181: Microsoft SQL Server formatmessage Function DoS
- OSVDB ID: 10183: Microsoft SQL Server xp_sprintf Function DoS
- US-CERT VU#700575: Buffer overflows in Microsoft SQL Server 7.0 and SQL Server 2000
Platforms Affected:
- Microsoft SQL Server 2000
- Microsoft SQL Server 7.0
Reported:
Dec 20, 2001
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this