CVE-2008-5416
- State
- Published
- Severity
- Not scored
- Published
- Dec 10, 2008
- Updated
- Aug 7, 2024
- Reserved
- Dec 10, 2008
Description
Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka "SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability."
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt
- ADV-2008-3380vdb-entry
- 33034third-party-advisory
- 50917vdb-entry
- 1021363vdb-entry
- 7501exploit
- 1021490vdb-entry
- mssql-spreplwritetovarbin-bo(47182)vdb-entry
- VU#696644third-party-advisory
- 20081209 SEC Consult SA-20081109-0 :: Microsoft SQL Server 2000 sp_replwritetovarbin limited memory overwrite vulnerabilitymailing-list
- 20081210 Microsoft SQL Server 2005 sp_replwritetovarbin memory overwrite(update to SEC Consult SA-20081209)mailing-list
- MS09-004vendor-advisory
- 4706third-party-advisory
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- http://www.microsoft.com/technet/security/advisory/961040.mspx
- 32710vdb-entry
- oval:org.mitre.oval:def:6217vdb-entrysignature
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- TA09-041Athird-party-advisory
- 20081210 Microsoft SQL Server 2005 sp_replwritetovarbin memory overwrite (update to SEC Consult SA-20081209)mailing-list
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESXmailing-list
- http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.