BID:12960

Microsoft Jet Database Engine Malformed Database File Buffer Overflow Vulnerability

Info

Microsoft Jet Database Engine Malformed Database File Buffer Overflow Vulnerability

Bugtraq ID:	12960
Class:	Boundary Condition Error
CVE:	CVE-2005-0944
Remote:	Yes
Local:	No
Published:	Mar 31 2005 12:00AM
Updated:	May 29 2008 03:13PM
Credit:	<[email protected]> disclosed this vulnerability.
Vulnerable:	Microsoft JET 4.0 SP7 Microsoft JET 4.0 SP6 Microsoft JET 4.0 SP5 Microsoft JET 4.0 SP4 Microsoft JET 4.0 SP3 Microsoft JET 4.0 SP2 Microsoft JET 4.0 SP1 Microsoft JET 4.0 + Microsoft Access 2000 + Microsoft Access 2000 Microsoft JET 3.51 SP3 Microsoft JET 3.51 + Microsoft Excel 95 + Microsoft Excel 95 + Microsoft Excel 97 + Microsoft Excel 97 Microsoft JET 3.5 + Microsoft Access 95 + Microsoft Access 95 + Microsoft Access 97 + Microsoft Access 97 Microsoft JET 3.0 + Microsoft Access 95 + Microsoft Access 95 Microsoft JET 2.5 + Microsoft Access 2.0 SP1 + Microsoft Access 2.0 SP1 Microsoft JET 2.0 + Microsoft Access 2.0 + Microsoft Access 2.0 Microsoft Access 2003 Microsoft Access 2002 SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Access 2002 SP1 Microsoft Access 2002 + Microsoft Office XP - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Access 2000 SR1 Microsoft Access 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Access 2000 SP2 Microsoft Access 2000 + Microsoft Office 2000 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0

Not Vulnerable:

Discussion

Microsoft Jet Database Engine Malformed Database File Buffer Overflow Vulnerability

Microsoft Jet Database Engine is vulnerable to a buffer-overflow vulnerability because the library fails to properly bounds-check the contents of user-supplied database files.

Attackers may exploit this vulnerability to execute arbitrary machine code in the context of the victim trying to access a malicious Jet database file.

This vulnerability is reported to reside in the 'msjet40.dll' library, version 4.00.8618.0. Older versions may also be affected. The 'msjetole40.dll' OLE (Object Linking and Embedding) library is reportedly immune to this vulnerability.

The Backdoor.Hesive trojan is reported to employ this vulnerability to install itself on vulnerable computers. Please see the web reference for more information.

Exploit / POC

Microsoft Jet Database Engine Malformed Database File Buffer Overflow Vulnerability

The following exploits have been made available:

/data/vulnerabilities/exploits/msjetBufferOverflowExploit.c
/data/vulnerabilities/exploits/msJetExploit.pl
/data/vulnerabilities/exploits/msjet-bindshell.c

Solution / Fix

Microsoft Jet Database Engine Malformed Database File Buffer Overflow Vulnerability

Solution:
Microsoft Security Bulletin MS08-028 addresses this issue. Please see the references for more information.

Microsoft JET 4.0 SP1