Lucene search

[email protected]NVD:CVE-2008-0107

HistoryJul 08, 2008 - 11:41 p.m.

CVE-2008-0107

2008-07-0823:41:00

CWE-189

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

AI Score

7.7

Confidence

High

EPSS

0.429

Percentile

97.4%

JSON

Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 allows remote authenticated users to execute arbitrary code via a (1) SMB or (2) WebDAV pathname for an on-disk file (aka stored backup file) with a crafted record size value, which triggers a heap-based buffer overflow, aka “SQL Server Memory Corruption Vulnerability.”

Affected configurations

Nvd

Node

microsoftdata_engineMatch1.0sp4

microsoftsql_serverMatch7.0sp4

microsoftsql_serverMatch2000sp4

microsoftsql_serverMatch2000sp4itanium

microsoftsql_serverMatch2005sp1

microsoftsql_serverMatch2005sp1express

microsoftsql_serverMatch2005sp1itanium

microsoftsql_serverMatch2005sp1x64

microsoftsql_serverMatch2005sp2

microsoftsql_serverMatch2005sp2express

microsoftsql_serverMatch2005sp2itanium

microsoftsql_serverMatch2005sp2x64

microsoftsql_server_desktop_engineMatch2000sp4

Node

microsoftwmsdeMatch2000

microsoftwyukonsp2

AND

microsoftwindows_2003_serversp1

microsoftwindows_2003_serversp2

Node

microsoftwmsdeMatch2000

microsoftwyukonsp2x64

AND

microsoftwindows_server_2003

microsoftwindows_server_2003sp2

Node

microsoftwyukonsp2

microsoftwyukonsp2x64

AND

microsoftwindows_server_2008x32

microsoftwindows_server_2008x64

VendorProductVersionCPE
microsoftdata_engine1.0cpe:2.3:a:microsoft:data_engine:1.0:sp4:*:*:*:*:*:*
microsoftsql_server7.0cpe:2.3:a:microsoft:sql_server:7.0:sp4:*:*:*:*:*:*
microsoftsql_server2000cpe:2.3:a:microsoft:sql_server:2000:sp4:*:*:*:*:*:*
microsoftsql_server2000cpe:2.3:a:microsoft:sql_server:2000:sp4:itanium:*:*:*:*:*
microsoftsql_server2005cpe:2.3:a:microsoft:sql_server:2005:sp1:*:*:*:*:*:*
microsoftsql_server2005cpe:2.3:a:microsoft:sql_server:2005:sp1:express:*:*:*:*:*
microsoftsql_server2005cpe:2.3:a:microsoft:sql_server:2005:sp1:itanium:*:*:*:*:*
microsoftsql_server2005cpe:2.3:a:microsoft:sql_server:2005:sp1:x64:*:*:*:*:*
microsoftsql_server2005cpe:2.3:a:microsoft:sql_server:2005:sp2:*:*:*:*:*:*
microsoftsql_server2005cpe:2.3:a:microsoft:sql_server:2005:sp2:express:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	data_engine	1.0	cpe:2.3:a:microsoft:data_engine:1.0:sp4::::::
microsoft	sql_server	7.0	cpe:2.3:a:microsoft:sql_server:7.0:sp4::::::
microsoft	sql_server	2000	cpe:2.3:a:microsoft:sql_server:2000:sp4::::::
microsoft	sql_server	2000	cpe:2.3:a:microsoft:sql_server:2000:sp4:itanium:::::*
microsoft	sql_server	2005	cpe:2.3:a:microsoft:sql_server:2005:sp1::::::
microsoft	sql_server	2005	cpe:2.3:a:microsoft:sql_server:2005:sp1:express:::::*
microsoft	sql_server	2005	cpe:2.3:a:microsoft:sql_server:2005:sp1:itanium:::::*
microsoft	sql_server	2005	cpe:2.3:a:microsoft:sql_server:2005:sp1:x64:::::*
microsoft	sql_server	2005	cpe:2.3:a:microsoft:sql_server:2005:sp2::::::
microsoft	sql_server	2005	cpe:2.3:a:microsoft:sql_server:2005:sp2:express:::::*