Microsoft SQL-Server Buffer Overflow Vulnerability

Bugtraq ID:	3733
Class:	Boundary Condition Error
CVE:	CVE-2001-0542
Remote:	Yes
Local:	No
Published:	Dec 20 2001 12:00AM
Updated:	Jul 11 2009 09:06AM
Credit:	Credited to Chris Anley of @Stake.
Vulnerable:	Microsoft SQL Server 2000 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 Microsoft SQL Server 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 Microsoft SQL Server 7.0 SP3 alpha Microsoft SQL Server 7.0 SP3 - Microsoft SQL Server 7.0 - Microsoft SQL Server 7.0 Microsoft SQL Server 7.0 SP2 alpha Microsoft SQL Server 7.0 SP2 - Microsoft SQL Server 7.0 - Microsoft SQL Server 7.0 Microsoft SQL Server 7.0 SP1 alpha Microsoft SQL Server 7.0 SP1 - Microsoft SQL Server 7.0 - Microsoft SQL Server 7.0 Microsoft SQL Server 7.0 alpha Microsoft SQL Server 7.0 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0
Not Vulnerable:	Microsoft SQL Server 2000 SP2

Microsoft SQL-Server Buffer Overflow Vulnerability

Microsoft SQL Server contains buffer overflows in several built-in text formatting and printing functions.

This vulnerability makes it possible for an attacker to execute arbitrary code in the security context of the server process. An attacker can also exploit this vulnerability to crash the server.

Microsoft SQL-Server Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft SQL-Server Buffer Overflow Vulnerability

Solution:
Fixes are available:


Microsoft SQL Server 2000

• Microsoft sql2ksp2
  SQL Server 2000 Service Pack 2.
  http://www.microsoft.com/sql/downloads/2000/sp2.asp

Microsoft SQL Server 7.0 SP3

• Microsoft S71004i
  This fix requires Service Pack 3.
  http://support.microsoft.com/default.aspx?scid=http://download.microso ft.com/download/sql70/Patch/1.0/Win98MeXP/EN-US/S71004i.exe

Microsoft SQL Server 7.0 SP3 alpha

• Microsoft S71004a
  This fix requires Service Pack 3.
  http://support.microsoft.com/default.aspx?scid=http://download.microso ft.com/download/sql70/Patch/1.0/Win98MeXP/EN-US/S71004a.exe

Microsoft SQL Server 2000 SP1

• Microsoft sql2ksp2
  SQL Server 2000 Service Pack 2.
  http://www.microsoft.com/sql/downloads/2000/sp2.asp


• Microsoft s80428i
  This fix requires Service Pack 1. The fix for SQL Server 2000 SP1 is included in SQL Server 2000 Service Pack 2 (SP2). This fix should only be applied if administrators are currently unable to upgrade to SP2.
  http://support.microsoft.com/default.aspx?scid=http://download.microso ft.com/download/SQLSVR2000/Patch/1.0/W98NT42KMeXP/EN-US/s80428i.exe

Microsoft SQL-Server Buffer Overflow Vulnerability

References:

• @stake advisory: Multiple overflow and format string vulnerabilities in MSSQL (@stake advisories )
  
• Microsoft Security Bulletin (MS01-060) (Microsoft)
  
• Vulnerability Note VU#700575 (CERT/CC)