Microsoft SQL Server OLE DB provider name "ad hoc" connection buffer overflow
| mssql-oledb-adhoc-bo (8243) |  High Risk |
Description:
Microsoft SQL Server is vulnerable to a denial of service attack, caused by a buffer overflow in the handling of certain "ad hoc" connections. By sending an overly long string in the OLE DB provider name parameter to the OpenDataSource or OpenRowset function, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the SQL Server process to fail.
Platforms Affected:
- Microsoft, SQL Server 2000
- Microsoft, SQL Server 7.0
- Microsoft, Windows 2003 Server
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin. See References.
For Microsoft SQL Server 7.0:
Microsoft originally provided a patch for this vulnerability in MS02-007, MS02-020, MS02-043, MS02-056, and MS02-061, but they were superseded by the patch released with MS03-031.
For Microsoft SQL Server 2000:
Microsoft originally provided a patch for this vulnerability in MS02-007, MS02-020, MS02-034, MS02-038, MS02-039, MS02-043, MS02-056, and MS02-061, but they were superseded by the patch released with MS03-031.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Tue Feb 19 2002 - 16:10:01 CST, MSDE, Sql Server 7 & 2000 Adhoc Heterogenous Queries Buffer Overflow and DOS at http://archives.neohapsis.com/archives/bugtraq/2002-02/0210.html.
- CERT Advisory CA-2002-22, Multiple Vulnerabilities in Microsoft SQL Server at http://www.cert.org/advisories/CA-2002-22.html.
- CIAC Information Bulletin M-044, Microsoft SQL Server Remote Data Source Function Contains Unchecked Buffers at http://www.ciac.org/ciac/bulletins/m-044.shtml.
- Microsoft Security Bulletin MS02-007, SQL Server Remote Data Source Function Contain Unchecked Buffers at http://www.microsoft.com/technet/security/bulletin/ms02-007.mspx.
- Microsoft Security Bulletin MS02-020, SQL Extended Procedure Functions Contain Unchecked Buffers (Q319507) at http://www.microsoft.com/technet/security/bulletin/MS02-020.mspx.
- Microsoft Security Bulletin MS02-034, Cumulative Patch for SQL Server (Q316333) at http://www.microsoft.com/technet/security/bulletin/MS02-034.mspx.
- Microsoft Security Bulletin MS02-038, Unchecked Buffer in SQL Server 2000 Utilities Could Allow Code Execution (Q316333) at http://www.microsoft.com/technet/security/bulletin/MS02-038.mspx.
- Microsoft Security Bulletin MS02-039, Buffer Overruns in SQL Server 2000 Resolution Service Could Enable Code Execution (Q323875) at http://www.microsoft.com/technet/security/bulletin/MS02-039.mspx.
- Microsoft Security Bulletin MS02-043, Cumulative Patch for SQL Server (Q316333) at http://www.microsoft.com/technet/security/bulletin/MS02-043.mspx.
- Microsoft Security Bulletin MS02-056, Cumulative Patch for SQL Server (Q316333) at http://www.microsoft.com/technet/security/bulletin/MS02-056.mspx.
- Microsoft Security Bulletin MS02-061, Elevation of Privilege in SQL Server Web Tasks (Q316333) at http://www.microsoft.com/technet/security/Bulletin/MS02-061.mspx.
- Microsoft Security Bulletin MS03-031, Cumulative Patch for Microsoft SQL Server (815495) at http://www.microsoft.com/technet/security/bulletin/ms03-031.mspx.
- BID-4135: Microsoft SQL Server OLE DB Provider Name Buffer Overflow Vulnerability
- CVE-2002-0056: Buffer overflow in SQL Server 7.0 and 2000 allows remote attackers to execute arbitrary code via a long OLE DB provider name to (1) OpenDataSource or (2) OpenRowset in an ad hoc connection.
- US-CERT VU#619707: Microsoft SQL Server contains buffer overflows in openrowset and opendatasource macros
Reported:
Feb 19, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net