Microsoft SQL Server Buffer Overflow and Format String Vulnerabilities (CAN-2001-0542)

Key Information Advisory Name: - Multiple Buffer Overflows and Format String Vulnerabilities in Microsoft SQL Server Release Date: - December 20, 2001 Application: - Microsoft SQL Server 7.0 and 2000 Platform: - Microsoft Windows NT 4.0, 2000, and XP Severity: - Database users can execute arbitrary code or cause denial of service on the server Author: - Chris Anley [chrisanley@hushmail.com] and Chris Wysopal [cwyso@atstake.com] Vendor Status: - Vendor has issued advisory and patch CVE Candidate: - CAN-2001-0542 Reference: - http://www.atstake.com/research/advisories/2001/a122001-1.txt Overview This advisory describes multiple vulnerabilities in Microsoft SQL Server 7.0 and 2000 that allow attackers to execute arbitrary code in the context of the account under which SQL Server runs (typically an administrator). Description SQL Server provides built-in functions that use C-style format specifiers to format error messages. These functions are accessible to all users. Supplying maliciously crafted input to these functions can lead to exploitable error conditions within the SQL Server process. To launch this attack, an attacker must have permission to execute SQL queries, either directly or via exploitation of SQL command injection vulnerabilities. The function is accessible to all users and allows specification of excessively long length specifiers, leading to exploitable overflow conditions. Additionally, format string specifiers can be used to enable attackers to overwrite arbitrary memory addresses, potentially resulting in arbitrary code execution. The built-in function is also accessible to all users. By crafting specific messages, any user can trigger the execution of malicious code embedded within the message. The extended stored procedure (accessible by default to the public role) allows specification of excessively long length specifiers, which can lead to exploitable overflow conditions. Recommendations Apply vendor patches Do not allow untrusted users direct access to SQL Server. This can be achieved by: - Using SQL Server Network Utility to remove all unused connection "protocols" - Using network packet filtering devices such as firewalls - Configuring Windows 2000 IP Security filters to allow only trusted connections

Goal Reached Thanks to every supporter — we hit 100%!

Microsoft SQL Server Buffer Overflow and Format String Vulnerabilities (CAN-2001-0542)