Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2008-0107

Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 allows remote authenticated users to execute arbitrary code via a (1) SMB or (2) WebDAV pathname for an on-disk file (aka stored backup file) with a crafted record size value, which triggers a heap-based buffer overflow, aka "SQL Server Memory Corruption Vulnerability."

Published

2008-07-08T23:41:00.000

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.0

Impact Score

10.0

Weaknesses

Type: Primary
CWE-189

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	microsoft	data_engine	1.0	Yes
Application	microsoft	sql_server	7.0	Yes
Application	microsoft	sql_server	2000	Yes
Application	microsoft	sql_server	2000	Yes
Application	microsoft	sql_server	2005	Yes
Application	microsoft	sql_server	2005	Yes
Application	microsoft	sql_server	2005	Yes
Application	microsoft	sql_server	2005	Yes
Application	microsoft	sql_server	2005	Yes
Application	microsoft	sql_server	2005	Yes
Application	microsoft	sql_server	2005	Yes
Application	microsoft	sql_server	2005	Yes
Application	microsoft	sql_server_desktop_engine	2000	Yes
Application	microsoft	wmsde	2000	Yes
Application	microsoft	wyukon	*	Yes
Operating System	microsoft	windows_2003_server	*	No
Operating System	microsoft	windows_2003_server	*	No
Application	microsoft	wmsde	2000	Yes
Application	microsoft	wyukon	*	Yes
Operating System	microsoft	windows_server_2003	*	No
Operating System	microsoft	windows_server_2003	*	No
Application	microsoft	wyukon	*	Yes
Application	microsoft	wyukon	*	Yes
Operating System	microsoft	windows_server_2008	*	Yes
Operating System	microsoft	windows_server_2008	*	Yes

References

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=723 ([email protected])
http://secunia.com/advisories/30970 Vendor Advisory ([email protected])
http://www.insomniasec.com/advisories/ISVA-080709.1.htm ([email protected])
http://www.securityfocus.com/archive/1/494082/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/516397/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/30119 ([email protected])
http://www.securitytracker.com/id?1020441 ([email protected])
http://www.us-cert.gov/cas/techalerts/TA08-190A.html US Government Resource ([email protected])
http://www.vmware.com/security/advisories/VMSA-2011-0003.html ([email protected])
http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html ([email protected])
http://www.vupen.com/english/advisories/2008/2022/references Vendor Advisory ([email protected])
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-040 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13936 ([email protected])
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=723 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/30970 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.insomniasec.com/advisories/ISVA-080709.1.htm (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/494082/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/516397/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/30119 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1020441 (af854a3a-2127-422b-91ae-364da2661108)
http://www.us-cert.gov/cas/techalerts/TA08-190A.html US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.vmware.com/security/advisories/VMSA-2011-0003.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2008/2022/references Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-040 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13936 (af854a3a-2127-422b-91ae-364da2661108)