{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cUL\u003e    \u003cLI\u003eMicrosoft SQL Server 2000 ;\u003c/LI\u003e    \u003cLI\u003eMicrosoft SQL Server 2005 ;\u003c/LI\u003e    \u003cLI\u003eMicrosoft SQL Server 2005 Express Edition ;\u003c/LI\u003e    \u003cLI\u003eMicrosoft SQL Server 2000 Desktop Engine (MSDE 2000 et    WMSDE) ;\u003c/LI\u003e    \u003cLI\u003eWindows Internal Database (WYukon).\u003c/LI\u003e  \u003c/UL\u003e  \u003cP\u003eLes syst\u00e8mes Microsoft SQL Server 7.0 SP 4, Microsoft SQL  Server 2005 SP3 et Microsoft SQL Server 2008 ne seraient pas  affect\u00e9s.\u003c/P\u003e",
  "closed_at": "2009-02-11",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire dans la proc\u00e9dure\nstock\u00e9e \u00e9tendue sp_replwritetovarbin() de Microsoft SQL Server permet \u00e0\nune personne malintentionn\u00e9e d\u0027ex\u00e9cuter du code arbitraire.\n\nAssoci\u00e9e \u00e0 une vuln\u00e9rabilit\u00e9 de type injection de code SQL, cette\nvuln\u00e9rabilit\u00e9 permet une ex\u00e9cution de code \u00e0 distance.\n\n## Contournement provisoire\n\nIl est recommand\u00e9 de supprimer la proc\u00e9dure stock\u00e9e \u00e9tendue vuln\u00e9rable\nou d\u0027en changer les droits d\u0027ex\u00e9cution (cf. section Documentation).\n\nCeci peut entrainer des dysfonctionnements dans d\u0027autres applications.\n\nLes bonnes pratiques en mati\u00e8re de d\u00e9veloppement Web, notamment pour se\nprot\u00e9ger des injections SQL peuvent limiter les possibilit\u00e9s\nd\u0027exploitation de cette vuln\u00e9rabilit\u00e9.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 Microsoft MS09-004 pour l\u0027obtention\ndes correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-5416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-5416"
    }
  ],
  "initial_release_date": "2008-12-12T00:00:00",
  "last_revision_date": "2009-02-11T00:00:00",
  "links": [
    {
      "title": "Avis de s\u00e9curit\u00e9 Microsoft 961040 du 22 d\u00e9cembre    2008\u00a0:",
      "url": "http://www.microsoft.com/technet/security/advisory/961040.mspx"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS09-004 du 10 f\u00e9vrier 2009    :",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS09-004.mspx"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS09-004 du 10 f\u00e9vrier 2009    :",
      "url": "http://www.microsoft.com/france/technet/security/Bulletin/MS09-004.mspx"
    },
    {
      "title": "Avis CERTA-2009-AVI-061 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2009-AVI-061/index.html"
    },
    {
      "title": "D\u00e9sactivation de proc\u00e9dures stock\u00e9es \u00e9tendues :",
      "url": "http://msdn.microsoft.com/fr-fr/library/ms189506.aspx"
    },
    {
      "title": "Bloc-notes SVRD, \"More information about the SQL stored    procedure vulnerability\", 22 d\u00e9cembre 2008\u00a0:",
      "url": "http://blogs.technet.com/swi/archive/2008/12/22/more-information-about-the-sql-stored-procedure-vulnerability.aspx"
    },
    {
      "title": "R\u00e9f\u00e9rence CVE CVE-5416:",
      "url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5416"
    },
    {
      "title": "Bloc-notes MSRC, \"Microsoft Security Advisory 961040\" du 22    d\u00e9cembre 2008\u00a0:",
      "url": "http://blogs.technet.com/msrc/archive/2008/12/22/microsoft-security-advisory-961040.aspx"
    }
  ],
  "reference": "CERTA-2008-ALE-017",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-12-12T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence CVE, des liens Microsoft et mise \u00e0 jour des versions vuln\u00e9rables.",
      "revision_date": "2008-12-23T00:00:00.000000"
    },
    {
      "description": "ajout de la section solution et modification du CVE",
      "revision_date": "2009-02-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans \u003cspan class=\"textit\"\u003eMicrosoft SQL Server\u003c/span\u003e\npermet \u00e0 une personne malintentionn\u00e9e d\u0027ex\u00e9cuter du code arbitraire.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Microsoft SQL Server",
  "vendor_advisories": []
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft SQL Server 2000 SP4 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2005 SP2 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows Internal Database SP2.",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2000 Desktop Engine ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 concernant une erreur de v\u00e9rification des param\u00e8tres\ndans la proc\u00e9dure stock\u00e9e sp_replwritetovarbin a \u00e9t\u00e9 corrig\u00e9e. Elle\npermet l\u0027ex\u00e9cution de code arbitraire \u00e0 distance par une personne\nmalveillante, connect\u00e9e au serveur ou utilisant une injection de code\nSQL.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 Microsoft MS09-004 pour l\u0027obtention\ndes correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-5416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-5416"
    }
  ],
  "initial_release_date": "2009-02-11T00:00:00",
  "last_revision_date": "2009-02-11T00:00:00",
  "links": [],
  "reference": "CERTA-2009-AVI-061",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-02-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 affectant \u003cspan class=\"textit\"\u003eMicrosoft SQL\nServer\u003c/span\u003e permettant l\u0027ex\u00e9cution de code arbitraire \u00e0 distance a \u00e9t\u00e9\ncorrig\u00e9e.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Microsoft SQL",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS09-004 du 10 f\u00e9vrier 2009",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS09-004.mspx"
    }
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5D559EE-727C-405C-987C-247973A84D32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2005:*:*:*:*:*:*:*",
              "matchCriteriaId": "36909BE0-9171-456B-9323-4DB04F921DE9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka \"SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Un desbordamiento de b\u00fafer en la regi\u00f3n heap de la memoria en SQL Server 2000 SP4, versiones 8.00.2050, 8.00.2039 y anteriores; Motor SQL Server 2000 Desktop (MSDE 2000) SP4; SQL Server 2005 SP2 y versi\u00f3n 9.00.1399.06; Motor SQL Server 2000 Desktop (WMSDE) en Windows Server 2003 SP1 y SP2; y Windows Internal Database (WYukon) SP2, de Microsoft, permite a los usuarios autenticados remotos causar una denegaci\u00f3n de servicio (excepci\u00f3n de violaci\u00f3n de acceso) o ejecutar c\u00f3digo arbitrario mediante una llamada a un procedimiento almacenado extendido sp_replwritetovarbin con un conjunto de par\u00e1metros no v\u00e1lidos que desencadenan la sobrescritura de memoria, tambi\u00e9n se conoce como \"SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability\"."
    }
  ],
  "id": "CVE-2008-5416",
  "lastModified": "2026-06-16T22:59:56.097",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-12-10T14:00:01.207",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/50917"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/33034"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/4706"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1021363"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1021490"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/696644"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.microsoft.com/technet/security/advisory/961040.mspx"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/499042/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/499085/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/516397/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/32710"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-041A.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/3380"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47182"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6217"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/7501"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/50917"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/33034"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/4706"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1021363"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1021490"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/696644"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.microsoft.com/technet/security/advisory/961040.mspx"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/499042/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/499085/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/516397/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/32710"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-041A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/3380"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47182"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6217"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/7501"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-5416"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-12-10T14:00:00Z",
    "severity": "HIGH"
  },
  "details": "Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka \"SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability.\"",
  "id": "GHSA-qhrx-q7mr-q5x7",
  "modified": "2022-05-14T02:36:48Z",
  "published": "2022-05-14T02:36:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5416"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47182"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6217"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/7501"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.html"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/50917"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33034"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/4706"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1021363"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1021490"
    },
    {
      "type": "WEB",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/696644"
    },
    {
      "type": "WEB",
      "url": "http://www.microsoft.com/technet/security/advisory/961040.mspx"
    },
    {
      "type": "WEB",
      "url": "http://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/499042/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/499085/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/516397/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/32710"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-041A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/3380"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "GSD": {
    "alias": "CVE-2008-5416",
    "description": "Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka \"SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability.\"",
    "id": "GSD-2008-5416",
    "references": [
      "https://packetstormsecurity.com/files/cve/CVE-2008-5416"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2008-5416"
      ],
      "details": "Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka \"SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability.\"",
      "id": "GSD-2008-5416",
      "modified": "2023-12-13T01:23:04.351458Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2008-5416",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka \"SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability.\""
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt",
            "refsource": "MISC",
            "url": "http://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt"
          },
          {
            "name": "ADV-2008-3380",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2008/3380"
          },
          {
            "name": "33034",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/33034"
          },
          {
            "name": "50917",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/50917"
          },
          {
            "name": "1021363",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1021363"
          },
          {
            "name": "7501",
            "refsource": "EXPLOIT-DB",
            "url": "https://www.exploit-db.com/exploits/7501"
          },
          {
            "name": "1021490",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1021490"
          },
          {
            "name": "mssql-spreplwritetovarbin-bo(47182)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47182"
          },
          {
            "name": "VU#696644",
            "refsource": "CERT-VN",
            "url": "http://www.kb.cert.org/vuls/id/696644"
          },
          {
            "name": "20081209 SEC Consult SA-20081109-0 :: Microsoft SQL Server 2000 sp_replwritetovarbin limited memory overwrite vulnerability",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/499042/100/0/threaded"
          },
          {
            "name": "20081210 Microsoft SQL Server 2005 sp_replwritetovarbin memory overwrite(update to SEC Consult SA-20081209)",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/499085/100/0/threaded"
          },
          {
            "name": "MS09-004",
            "refsource": "MS",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004"
          },
          {
            "name": "4706",
            "refsource": "SREASON",
            "url": "http://securityreason.com/securityalert/4706"
          },
          {
            "name": "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html",
            "refsource": "CONFIRM",
            "url": "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html"
          },
          {
            "name": "http://www.microsoft.com/technet/security/advisory/961040.mspx",
            "refsource": "CONFIRM",
            "url": "http://www.microsoft.com/technet/security/advisory/961040.mspx"
          },
          {
            "name": "32710",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/32710"
          },
          {
            "name": "oval:org.mitre.oval:def:6217",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6217"
          },
          {
            "name": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html",
            "refsource": "CONFIRM",
            "url": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html"
          },
          {
            "name": "TA09-041A",
            "refsource": "CERT",
            "url": "http://www.us-cert.gov/cas/techalerts/TA09-041A.html"
          },
          {
            "name": "20081210 Microsoft SQL Server 2005 sp_replwritetovarbin memory overwrite (update to SEC Consult SA-20081209)",
            "refsource": "FULLDISC",
            "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.html"
          },
          {
            "name": "20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/516397/100/0/threaded"
          },
          {
            "name": "http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm",
            "refsource": "CONFIRM",
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:sql_server:2005:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-5416"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka \"SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt",
              "refsource": "MISC",
              "tags": [
                "Exploit"
              ],
              "url": "http://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt"
            },
            {
              "name": "33034",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/33034"
            },
            {
              "name": "32710",
              "refsource": "BID",
              "tags": [
                "Exploit"
              ],
              "url": "http://www.securityfocus.com/bid/32710"
            },
            {
              "name": "1021363",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://securitytracker.com/id?1021363"
            },
            {
              "name": "1021490",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://securitytracker.com/id?1021490"
            },
            {
              "name": "http://www.microsoft.com/technet/security/advisory/961040.mspx",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.microsoft.com/technet/security/advisory/961040.mspx"
            },
            {
              "name": "VU#696644",
              "refsource": "CERT-VN",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.kb.cert.org/vuls/id/696644"
            },
            {
              "name": "4706",
              "refsource": "SREASON",
              "tags": [],
              "url": "http://securityreason.com/securityalert/4706"
            },
            {
              "name": "TA09-041A",
              "refsource": "CERT",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.us-cert.gov/cas/techalerts/TA09-041A.html"
            },
            {
              "name": "50917",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/50917"
            },
            {
              "name": "20081210 Microsoft SQL Server 2005 sp_replwritetovarbin memory overwrite (update to SEC Consult SA-20081209)",
              "refsource": "FULLDISC",
              "tags": [],
              "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.html"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html"
            },
            {
              "name": "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html"
            },
            {
              "name": "ADV-2008-3380",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2008/3380"
            },
            {
              "name": "mssql-spreplwritetovarbin-bo(47182)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47182"
            },
            {
              "name": "7501",
              "refsource": "EXPLOIT-DB",
              "tags": [],
              "url": "https://www.exploit-db.com/exploits/7501"
            },
            {
              "name": "oval:org.mitre.oval:def:6217",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6217"
            },
            {
              "name": "20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/516397/100/0/threaded"
            },
            {
              "name": "20081210 Microsoft SQL Server 2005 sp_replwritetovarbin memory overwrite(update to SEC Consult SA-20081209)",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/499085/100/0/threaded"
            },
            {
              "name": "20081209 SEC Consult SA-20081109-0 :: Microsoft SQL Server 2000 sp_replwritetovarbin limited memory overwrite vulnerability",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/499042/100/0/threaded"
            },
            {
              "name": "MS09-004",
              "refsource": "MS",
              "tags": [],
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2018-10-12T21:49Z",
      "publishedDate": "2008-12-10T14:00Z"
    }
  }
}