Microsoft SQL Server Resolution Service heap buffer overflow
| mssql-resolution-service-bo (9661) |  High Risk |
Description:
Microsoft SQL Server 2000 is vulnerable to a heap buffer overflow in the SQL Server Resolution Service, which is used to direct client requests to the proper port when multiple instances of the SQL Server are running on the same system. By sending a specially-crafted request to UDP port 1434 consisting of a byte set to 0x08 followed by an overly long string and a colon character (:), a remote attacker could overflow a buffer and cause the SQL Server service to crash or execute arbitrary code on the system with the same privileges as the SQL Server.
Note: This vulnerability also affects Cisco CallManager version 3.3(x), Cisco Unity versions 3.x and 4.x, and Cisco Building Broadband Service Manager versions 5.0 and 5.1, which incorporates the use of either SQL Server 2000 or MSDE 2000.
This vulnerability is exploitable using the Slammer worm. The main function of the Slammer worm is propagation, sending 376 bytes of exploit and propagation code across port 1434/UDP until the SQL Server process is shut down.. No Distributed Denial of service (DDoS) or backdoor functionality is incorporated into the worm. Infection can be removed with a reboot, however without protection in place, it is likely that vulnerable servers will be quickly re-infected.
Platforms Affected:
- Cisco, Building Broadband Service Manager 5.0
- Cisco, Building Broadband Service Manager 5.1
- Cisco, Unified CallManager 3.3
- Cisco, Unity Server 3.0
- Cisco, Unity Server 4.0
- Microsoft, .NET Framework 1.0
- Microsoft, SQL Server 2000
Remedy:
For vulnerability detection:
Enable the following checks in the ISS Protection Platform:
MssqlResolutionServiceBo
Enable the following checks in the ISS Protection Platform:
SQL_SSRP_StackBo
SQL_SSRP_HeapBo
Block or restrict the following in the ISS Protection Platform as appropriate to the environment:
Port 1434
For Manual Protection:
Apply the patch for this vulnerability, as listed in Microsoft Security Bulletin MS02-039. See References.
For Cisco CallManager, Cisco Unity, and Cisco Building Broadband Service Manager: Refer to Cisco Security Advisory 2003 January 26 05:30 GMT for upgrade or patch information. See References.
Consequences:
Gain Access
References:
- CERT Advisory CA-2002-22, Multiple Vulnerabilities in Microsoft SQL Server at http://www.cert.org/advisories/CA-2002-22.html.
- CIAC Information Bulletin M-102, Microsoft SQL Server 2000 Resolution Service Buffer Overflow Vulnerabilities at http://www.ciac.org/ciac/bulletins/m-102.shtml.
- cisco-sa-20030126-ms02-061, Cisco Security Advisory: Microsoft SQL Server 2000 Vulnerabilities in Cisco Products - MS02-061 at http://www.cisco.com/warp/public/707/cisco-sa-20030126-ms02-061.shtml.
- Microsoft Security Bulletin MS02-039, Buffer Overruns in SQL Server 2000 Resolution Service Could Enable Code Execution (Q323875) at http://www.microsoft.com/technet/security/bulletin/ms02-039.mspx.
- NGSSoftware Insight Security Research Advisory #NISR03092002B, Windows .NET Server (RC1) and MSDE at http://www.nextgenss.com/advisories/dotnet-msde.txt.
- NGSSoftware Insight Security Research Advisory #NISR25072002, Unauthenticated Remote Compromise in MS SQL Server 2000 at http://www.ngssoftware.com/advisories/mssql-udp.txt.
- BID-5310: Microsoft SQL Server 2000 Resolution Service Heap Overflow Vulnerability
- CVE-2002-0649: Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.
- CVE-2002-0729: Microsoft SQL Server 2000 allows remote attackers to cause a denial of service via a malformed 0x08 packet that is missing a colon separator.
- SA7945: MS-SQL 2000 Worm propagating
- US-CERT VU#399260: Microsoft SQL Server 2000 contains heap buffer overflow in SQL Server Resolution Service
- US-CERT VU#484891: Microsoft SQL Server 2000 contains stack buffer overflow in SQL Server Resolution Service
Reported:
Jul 24, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net