CVE-2008-5416

EPSS 87.0%

Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka "SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability."

Affected products

n/a · n/a

public PoCs found — 4

githubgithub.com/SECFORCE/CVE-2008-5416★ 3 cve_referencewww.exploit-db.com/exploits/7501unverified exploitdbwww.exploit-db.com/exploits/16392unverified exploitdbwww.exploit-db.com/exploits/16396unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.html http://osvdb.org/50917 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004 http://secunia.com/advisories/33034 http://securityreason.com/securityalert/4706 http://securitytracker.com/id?1021363 http://securitytracker.com/id?1021490 https://exchange.xforce.ibmcloud.com/vulnerabilities/47182 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6217 http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm https://www.exploit-db.com/exploits/7501 http://www.kb.cert.org/vuls/id/696644