{"vuid":"VU#247545","idnumber":"247545","name":"Protegrity Secure.Data for Microsoft SQL Server 2000 contains buffer overflows in extended stored procedures","keywords":["Protegrity Secure.Data","Microsoft SQL Server","buffer overflow","xp_pty_checkusers","xp_pty_insert","xp_pty_select"],"overview":"Protegrity Secure.Data for Microsoft SQL Server 2000 includes several extended stored procedures that contain buffer overflow vulnerabilities. These vulnerabilities could allow a remote attacker to execute arbitrary code, gain access to databases, or cause a denial of service.","clean_desc":"Protegrity Secure.Data for Microsoft SQL Server 2000 provides access control and encryption for individual data records. Secure.Data interacts with Microsoft SQL Server via extended stored procedures that are part of the Secure.Data Extension Feature (SEF). From Microsoft Knowledge Base Article 190987:  \"Extended stored procedures provide a way to dynamically load and execute a function within a dynamic-link library (DLL) in a manner similar to that of a stored procedure, seamlessly extending SQL Server functionality.\"  Extended stored procedures execute under the security context and in the process space of SQL Server. By default, the SQL Server 2000 service runs as a Windows domain user. Several extended stored procedures (xp_pty_checkusers, xp_pty_insert, and xp_pty_select) included as part of the SEF contain buffer overflow vulnerabilities. These extended stored procedures could be exploited by specially crafted SQL commands.","impact":"A remote attacker could execute arbitrary code with the privileges of the SQL Server process or cause a denial of service. This could give an attacker full access to  databases stored on a vulnerable system.","resolution":"Upgrade\nProtegrity has issued an updated version of protegrity.dll (2.2.3.9) that resolves these vulnerabilities.","workarounds":"Restrict Access Using firewall or similar technology, restrict direct access to SQL servers to only those hosts and networks that require it. By default, SQL Server 2000 listens on port 1433/tcp. Named/clustered SQL instances may require special configuration. See Microsoft Knowledge Base Article 287932 for more information. Note that this will only limit the possible sources of attacks.","sysaffected":"","thanks":"This vulnerability was reported by <protegritysecvuln@yahoo.com>.","author":"This document was written by Art Manion.","public":["http://www.protegrity.com/The_Secure.Data_Suite.html","http://support.microsoft.com/default.aspx?scid=kb;en-us;287932","http://support.microsoft.com/default.aspx?scid=kb;en-us;243428","http://support.microsoft.com/default.aspx?scid=kb;EN-US;190987","http://msdn.microsoft.com/library/default.asp?url=/library/en-us/odssql/ods_6_con_00_6p9v.asp","http://msdn.microsoft.com/library/default.asp?url=/library/en-us/odssql/ods_6_con_01_9rxv.asp"],"cveids":["CVE-2003-0030"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2002-12-10T14:32:24Z","publicdate":"2003-03-13T00:00:00Z","datefirstpublished":"2003-03-13T16:58:00Z","dateupdated":"2003-03-13T23:06:34Z","revision":16,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"14","cam_exploitation":"2","cam_internetinfrastructure":"4","cam_population":"6","cam_impact":"19","cam_easeofexploitation":"11","cam_attackeraccessrequired":"16","cam_scorecurrent":"7.524","cam_scorecurrentwidelyknown":"9.7812","cam_scorecurrentwidelyknownexploited":"16.5528","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":7.524,"vulnote":null}