{"vuid":"VU#619707","idnumber":"619707","name":"Microsoft SQL Server contains buffer overflows in openrowset and opendatasource macros","keywords":["Microsoft SQL Server","buffer overflow","long string of characters","provider name parameter","MS02-007","openrowset","opendatasource"],"overview":"Microsoft SQL Server contains several buffer overflows in \"functions that are associated with connecting to remote data sources through 'ad hoc names.'\"","clean_desc":"Microsoft SQL Server versions 7.0 and 2000 contain buffer overflows in the openrowset and opendatasource macros. By calling these macros with an overly long provider name parameter, an intruder can interrupt the ordinary operation of the server or potentially execute arbitrary code with the privileges of the SQL server. For more information, see http://www.microsoft.com/technet/security/bulletin/MS02-007.asp In order to exploit this vulnerability, an intruder would need to be able to call one of the vulnerable macros directly, or be able to supply an inappropriate argument to a script that uses one of the vulnerable macros.","impact":"An intruder can execute arbitrary code with the privileges of the SQL service account. If the privileges of the service account are elevated via VU#796313, this vulnerability may result in compromise of the server host.","resolution":"Apply a patch as described in http://support.microsoft.com/support/misc/kblookup.asp?id=Q318268 or http://support.microsoft.com/support/misc/kblookup.asp?id=Q316333.","workarounds":"","sysaffected":"","thanks":"Our thanks to Microsoft Corporation for the information provided in their \nbulletin\n, and to Cesar Cerrudo, who reported this information on \nBugtraq\n and \nNTBugTraq","author":"This document was written by Shawn V. Hernan.","public":["http://www.microsoft.com/technet/security/bulletin/MS02-007.asp"," http://support.microsoft.com/support/misc/kblookup.asp?id=Q318268","http://support.microsoft.com/support/misc/kblookup.asp?id=Q316333","http://www.microsoft.com/technet/prodtechnol/sql/maintain/security/sql2ksec.asp","http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0202&L=NTBUGTRAQ&P=R4681","http://online.securityfocus.com/bid/4135","http://msdn.microsoft.com/library/en-us/acdata/ac_8_qd_12_23xd.asp"],"cveids":["CVE-2002-0056"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2002-02-20T19:19:08Z","publicdate":"2002-02-19T00:00:00Z","datefirstpublished":"2002-03-28T23:11:51Z","dateupdated":"2002-07-29T23:20:35Z","revision":26,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"18","cam_exploitation":"0","cam_internetinfrastructure":"10","cam_population":"15","cam_impact":"15","cam_easeofexploitation":"9","cam_attackeraccessrequired":"9","cam_scorecurrent":"9.568125","cam_scorecurrentwidelyknown":"10.2515625","cam_scorecurrentwidelyknownexploited":"17.0859375","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":9.568125,"vulnote":null}