bugtraq - Re: [Full-disclosure] iDefense Security Advisory 07.08.08: Microsoft SQL Server Restore Integer Underflow Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <918334.45595.qm@web54402.mail.yahoo.com>
Date: Tue, 8 Jul 2008 16:26:11 -0700 (PDT)
From: Cesar <cesarc56@...oo.com>
To: vulnwatch@...nwatch.org, full-disclosure@...ts.grok.org.uk,
	bugtraq@...urityfocus.com, iDefense Labs <labs-no-reply@...fense.com>
Subject: Re: [Full-disclosure] iDefense Security Advisory 07.08.08: Microsoft SQL Server Restore Integer Underflow Vulnerability


Just to clarify, the following SQL Server vulnerabilities vulnerabilities:

SQL Server Buffer Overrun Vulnerability - CVE-2008-0106
SQL Server Memory Corruption Vulnerability - CVE-2008-0107
Convert Buffer Overrun - CVE-2008-0086

 can be exploited to take complete control of the system on Windows 2003, 
it doesn't matter the user account under SQL Server service is running.

On Windows 2008 if the service is running under Network Service or Local Service account then full system compromise is always possible.

*see http://www.argeniss.com/research/TokenKidnapping.pdf 

Cesar.

--- On Tue, 7/8/08, iDefense Labs <labs-no-reply@...fense.com> wrote:

> From: iDefense Labs <labs-no-reply@...fense.com>
> Subject: [Full-disclosure] iDefense Security Advisory 07.08.08: Microsoft SQL Server Restore Integer Underflow Vulnerability
> To: vulnwatch@...nwatch.org, full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
> Date: Tuesday, July 8, 2008, 11:18 PM
> iDefense Security Advisory 07.08.08
> http://labs.idefense.com/intelligence/vulnerabilities/
> Jul 08, 2008
> 
> I. BACKGROUND
> 
> SQL Server is Microsoft's database server product. It
> supports the
> restoration and inspection of backups via SQL statements.
> For more
> information see the vendor's website found at the
> following URL.
> 
> http://www.microsoft.com/sql/default.mspx