{"vuid":"VU#696644","idnumber":"696644","name":"Microsoft SQL Server fails to properly validate parameters to the sp_replwritetovarbin extended stored procedure","keywords":["Microsoft SQL Server","sp_replwritetovarbin","memory overwrite","arbitrary code execution"],"overview":"A vulnerability in the Microsoft SQL Server sp_replwritetovarbin extended stored procedure could allow an authenticated attacker to execute arbitrary code on an affected server.","clean_desc":"Some versions of Microsoft SQL Server contain a vulnerability in the sp_replwritetovarbin stored procedure. The vulnerability could allow an attacker to modify heap memory and potentially execute arbitrary code. The vulnerability is described in SEC Consult Security Advisory < 20081209-0 >. Microsoft Security Bulletin MS09-004 provides further details, including affected database versions and workarounds. In order to access sp_replwritetovarbin, an attacker would need to authenticate to the database first. A separate SQL injection vulnerability in a web application could allow a remote, unauthenticated attacker to exploit the sp_replwritetovarbin vulnerability with the user credentials of the web application. Microsoft Security Advisory (954462) provides detection and mitigation advice for SQL injection vulnerabilities. Exploit code is publicly available for this vulnerability.","impact":"A local or remote authenticated attacker may be able to execute arbitrary code with the privileges of the SQL Server on the affected system. In the case of a SQL injection vulnerability in a web application that uses a vulnerable database, a remote attacker may be able to exploit the sp_replwritetovarbin vulnerability with credentials of the web application.","resolution":"Apply an update\nThis issue is addressed in Microsoft Security Bulletin MS09-004.","workarounds":"Workarounds Deny execute permissions on sp_replwritetovarbin as described in Microsoft Security Bulletin MS09-004. Alternatively, remove sp_replwritetovarbin using sp_dropextendedproc as described in SEC Consult Security Advisory < 20081209-0 > and \"Removing an Extended Stored Procedure from SQL Server.\" Removing execute permissions or removing sp_replwritetovarbin may impact application functionality.","sysaffected":"","thanks":"This vulnerability was reported by Bernhard Mueller of SEC Consult Vulnerability Lab.","author":"This document was written by Chad R Dougherty and Art Manion.","public":["http://www.sec-consult.com/files/20081209_mssql-sp_replwritetovarbin_memwrite.txt","http://www.milw0rm.com/exploits/7501","http://www.microsoft.com/technet/security/advisory/961040.mspx","http://msdn.microsoft.com/en-us/library/aa215995(SQL.80).aspx","http://msdn.microsoft.com/en-us/library/aa933290(SQL.80).aspx","http://www.microsoft.com/technet/security/advisory/954462.mspx","http://www.microsoft.com/technet/security/bulletin/ms09-004.mspx"],"cveids":["CVE-2008-5416"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2008-12-09T12:58:03Z","publicdate":"2008-12-09T00:00:00Z","datefirstpublished":"2008-12-24T22:26:19Z","dateupdated":"2009-02-11T03:09:49Z","revision":21,"vrda_d1_directreport":"0","vrda_d1_population":"2","vrda_d1_impact":"3","cam_widelyknown":"20","cam_exploitation":"0","cam_internetinfrastructure":"2","cam_population":"10","cam_impact":"18","cam_easeofexploitation":"5","cam_attackeraccessrequired":"12","cam_scorecurrent":"4.455","cam_scorecurrentwidelyknown":"4.455","cam_scorecurrentwidelyknownexploited":"8.505","ipprotocol":"","cvss_accessvector":"--","cvss_accesscomplexity":"--","cvss_authentication":null,"cvss_confidentialityimpact":"--","cvss_integrityimpact":"--","cvss_availabilityimpact":"--","cvss_exploitablity":null,"cvss_remediationlevel":"ND","cvss_reportconfidence":"ND","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"ND","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"0","cvss_basevector":"AV:--/AC:--/Au:--/C:--/I:--/A:--","cvss_temporalscore":"0","cvss_environmentalscore":"0","cvss_environmentalvector":"CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND","metric":4.455,"vulnote":null}