{"vuid":"VU#700575","idnumber":"700575","name":"Buffer overflows in Microsoft SQL Server 7.0 and SQL Server 2000","keywords":["buffer overflow","microsoft","MS01-060","SQL","sql server","security"],"overview":"There is a buffer overflow in Microsoft SQL Server 2000 and SQL Server 7.0 which could allow an intruder to execute arbitrary code on vulnerable systems.","clean_desc":"Microsoft Windows SQL Server 2000 and SQL Server 7.0 contain a buffer overflow in functions associated with text messages. For more information, see http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-060.asp\nhttp://www.atstake.com/research/advisories/2001/index_q1.html Quoting from MS01-060, The functions that contain the unchecked buffers are associated with creating, and in some cases displaying, text messages. SQL Server provides several functions that enable a database query to create formatted text. Intruders who can execute queries containing these functions can exploit a buffer overflow. An intruder who could load and execute queries of his own choosing would be able to exploit this vulnerability. Other intruders may be able to execute this vulnerability as well. Again, quoting from  MS01-060, If the database search [or other routine] called one of the affected functions, it might be possible for an attacker to construct a query that would cause [an affected] function to be called in such a way as to exploit the vulnerability. Clearly, this would require intimate knowledge of the internals of the database query. On the other hand, if the database query were poorly implemented, the attacker might not need to know its internal details in order to exploit the vulnerability. One frequently exploited implementation error occurs when a database query doesn’t adequately check its inputs before using them. In some cases, this would make it possible for an attacker to embed database commands – including, in this case, calls to the affected functions – within database query parameters. This underscores the need to always check input parameters before using them. Applying the patch protects against all these attack scenarios, though it is still wise to ensure that input parameters to SQL Server queries are closely examined to guard against other possible vulnerabilities or unauthorized access.","impact":"Intruders can execute arbitrary code with the privileges of the SQL server process.","resolution":"Apply a patch as described in MS01-060.","workarounds":"","sysaffected":"","thanks":"Our thanks to Microsoft for the information contained in their bulletin. Microsoft has publicly thanked Chris Anley of \n@Stake\n for reporting this issue to them.","author":"This document was written by Shawn V. Hernan.","public":["http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-060.asp","http://www.atstake.com/research/advisories/2001/index_q1.html","http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/sql/deploy/confeat/c05ppcsq.asp","http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/sql/maintain/security/sqlc2.asp","http://www.microsoft.com/Downloads/Release.asp?ReleaseID=35066","http://www.microsoft.com/Downloads/Release.asp?ReleaseID=35067","http://www.uniras.gov.uk/l1/l2/l3/brief2001/UNIRAS%20Briefing%20-%2025001%20-%20%20Microsoft%20-%20SQL%20Server%20Text%20Formatting%20Functions%20Contain%20unchecked%20Buffers%20(MS01-060).txt"],"cveids":["CVE-2001-0542"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2001-12-21T05:29:48Z","publicdate":"2001-12-20T00:00:00Z","datefirstpublished":"2001-12-21T06:15:47Z","dateupdated":"2002-01-09T16:48:35Z","revision":7,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"10","cam_population":"15","cam_impact":"18","cam_easeofexploitation":"15","cam_attackeraccessrequired":"8","cam_scorecurrent":"15.1875","cam_scorecurrentwidelyknown":"18.225","cam_scorecurrentwidelyknownexploited":"30.375","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":15.1875,"vulnote":null}