Microsoft SQL Server Resolution Service heap buffer overflow
| mssql-resolution-service-bo (9661) |  High Risk |
Description:
Microsoft SQL Server 2000 is vulnerable to a heap buffer overflow in the SQL Server Resolution Service, which is used to direct client requests to the proper port when multiple instances of the SQL Server are running on the same system. By sending a specially-crafted request to UDP port 1434 consisting of a byte set to 0x08 followed by an overly long string and a colon character (:), a remote attacker could overflow a buffer and cause the SQL Server service to crash or execute arbitrary code on the system with the same privileges as the SQL Server.
Note: This vulnerability also affects Cisco CallManager version 3.3(x), Cisco Unity versions 3.x and 4.x, and Cisco Building Broadband Service Manager versions 5.0 and 5.1, which incorporates the use of either SQL Server 2000 or MSDE 2000.
This vulnerability is exploitable using the Slammer worm. The main function of the Slammer worm is propagation, sending 376 bytes of exploit and propagation code across port 1434/UDP until the SQL Server process is shut down.. No Distributed Denial of service (DDoS) or backdoor functionality is incorporated into the worm. Infection can be removed with a reboot, however without protection in place, it is likely that vulnerable servers will be quickly re-infected.
*CVSS:
| Base Score: | 10 |
| Access Vector: | Remote |
| Access Complexity: | Low |
| Authentication: | Not Required |
| Confidentiality Impact: | Complete |
| Integrity Impact: | Complete |
| Availability Impact: | Complete |
| Temporal Score: | 8.3 |
| Exploitability: | Functional |
| Remediation Level: | Official-Fix |
| Report Confidence: | Confirmed |
Consequences:
Gain Access
Remedy:
For vulnerability detection:
Enable the following checks in the ISS Protection Platform:
MssqlResolutionServiceBo
Enable the following checks in the ISS Protection Platform:
SQL_SSRP_StackBo
SQL_SSRP_HeapBo
Block or restrict the following in the ISS Protection Platform as appropriate to the environment:
Port 1434
For Manual Protection:
Apply the patch for this vulnerability, as listed in Microsoft Security Bulletin MS02-039. See References.
For Cisco CallManager, Cisco Unity, and Cisco Building Broadband Service Manager: Refer to Cisco Security Advisory 2003 January 26 05:30 GMT for upgrade or patch information. See References.
References:
- CERT Advisory CA-2002-22: Multiple Vulnerabilities in Microsoft SQL Server.
- CIAC Information Bulletin M-102: Microsoft SQL Server 2000 Resolution Service Buffer Overflow Vulnerabilities.
- cisco-sa-20030126-ms02-061: Cisco Security Advisory: Microsoft SQL Server 2000 Vulnerabilities in Cisco Products - MS02-061.
- Microsoft Security Bulletin MS02-039: Buffer Overruns in SQL Server 2000 Resolution Service Could Enable Code Execution (Q323875).
- NGSSoftware Insight Security Research Advisory #NISR03092002B: Windows .NET Server (RC1) and MSDE.
- NGSSoftware Insight Security Research Advisory #NISR25072002: Unauthenticated Remote Compromise in MS SQL Server 2000.
- BID-5310: Microsoft SQL Server 2000 Resolution Service Heap Overflow Vulnerability
- CVE-2002-0649: Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.
- CVE-2002-0729: Microsoft SQL Server 2000 allows remote attackers to cause a denial of service via a malformed 0x08 packet that is missing a colon separator.
- SA7945: MS-SQL 2000 Worm propagating
- US-CERT VU#399260: Microsoft SQL Server 2000 contains heap buffer overflow in SQL Server Resolution Service
- US-CERT VU#484891: Microsoft SQL Server 2000 contains stack buffer overflow in SQL Server Resolution Service
Platforms Affected:
- Cisco Building Broadband Service Manager 5.0
- Cisco Building Broadband Service Manager 5.1
- Cisco Unified CallManager 3.3
- Cisco Unity Server 3.0
- Cisco Unity Server 4.0
- Microsoft .NET Framework 1.0
- Microsoft SQL Server 2000
Reported:
Jul 24, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.