Microsoft Security Bulletin MS08-040 - Important

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• This vulnerability requires that an attacker have database operator access to the database, log, database backup files, or log backup files.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Enable Common Criteria Compliance on SQL 2005 Service Pack 2

  To enable Common Criteria Compliance, execute the following script while connected to the SQL Server as an administrator. After running the script, restart SQL Server.

  sp_configure 'show advanced options', 1;
GO
RECONFIGURE;
GO
sp_configure 'common criteria compliance enabled', 1;
GO
RECONFIGURE
GO

  Impact of workaround. Enabling the Common Criteria Compliance option results in a slight performance degradation.

  How to undo the workaround. To disable Common Criteria Compliance, execute the following script while connected to the SQL Server as an administrator. After running the script, restart SQL Server.

  sp_configure 'show advanced options', 1;
GO
RECONFIGURE;
GO
sp_configure 'common criteria compliance enabled', 0;
GO
RECONFIGURE
GO

What is the scope of the vulnerability? 
An information disclosure vulnerability exists in the way that SQL Server manages memory page reuse. An attacker with database operator access who successfully exploited this vulnerability could access customer data that the attacker would otherwise be prohibited from viewing.

What causes the vulnerability? 
The vulnerability exists in the way that SQL Server manages memory page reuse. When reallocating memory, SQL Server fails to initialize memory pages.

What might an attacker use the vulnerability to do? 
An attacker could read the contents of memory pages that contained data from another user’s session.

How could an attacker exploit the vulnerability? 
An attacker with database operator access could assemble the uninitialized memory pages from another user’s session by directing a backup to a location that the attacker controls.

What systems are primarily at risk from the vulnerability? 
Systems where SQL Server is used by untrusted parties are primarily at risk.

What does the update do? 
The update removes the vulnerability by modifying the way that SQL Server manages page reuse.

How do I clean residual data from my databases? 
The following new system stored procedure is provided to physically clean residual data from the free space area of database pages in environments where the physical security of the data or backup files is at risk:

sp_clean_db_free_space

This stored procedure removes residual information left on database pages as a result of data modification routines in SQL Server. This procedure will clean all pages in all files of the database.

sp_clean_db_free_space
@dbname = 'database_name',
[ @cleaning_delay = 'delay_in_seconds' ]

Arguments

@dbname = 'database_name',

• The name of the database to clean. dbname is nvarchar(384) and cannot be NULL.

[ @cleaning_delay = 'delay_in_seconds' ]

• To reduce the impact on the IO system, a delay can be specified between the cleaning of pages. cleaning_delay is int with a default of 0.

The following example cleans all residual information from the AdventureWorks database.

USE Master
GO
EXEC sp_clean_db_free_space
@dbname = 'AdventureWorks';

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued. This security bulletin addresses the privately disclosed vulnerability as well as additional issues discovered through internal investigations.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state that could reduce the severity of exploitation of vulnerability. The following mitigating factors may be helpful in your situation:

• An attacker must have valid Windows logon credentials with user permissions to SQL in order to exploit this vulnerability.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Microsoft has not identified any workarounds for this vulnerability.

What is the scope of the vulnerability? 
An elevation of privilege vulnerability exists in the way that SQL Server converts SQL expressions from one data type to another. This vulnerability could allow an attacker to run code and take complete control of the system. An authenticated attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

What causes the vulnerability? 
The convert function in SQL Server insufficiently checks input strings. As a result, a buffer overrun could result, allowing an authenticated attacker to execute code of the attacker’s choice.

What might an attacker use the vulnerability to do? 
An authenticated attacker who successfully exploited this vulnerability could gain elevation of privilege on an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

How could an attacker exploit the vulnerability? 
An authenticated attacker could create a query that calls the convert function with a specially crafted expression, causing the function to overflow, allowing code execution.

What systems are primarily at risk from the vulnerability? 
Systems where SQL Server 2000 Service Pack 4 and Microsoft SQL Server 2000 Desktop Engine (WMSDE) is used are primarily at risk.

What does the update do? 
The update removes the vulnerability by allocating more memory for the convert function.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued. This security bulletin addresses the privately disclosed vulnerability as well as additional issues discovered through internal investigations.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• An attacker must have valid Windows logon credentials with user permissions to SQL in order to exploit this vulnerability.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Microsoft has not identified any workarounds for this vulnerability.

What is the scope of the vulnerability? 
An elevation of privilege vulnerability exists in the way that SQL Server validates data structures in on-disk files. This vulnerability could allow an authenticated attacker to run code and to take complete control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

What causes the vulnerability? 
SQL Server fails to sufficiently validate data structures in on-disk files. As a result, a buffer overrun could result and allow an authenticated attacker to execute code of the attacker’s choice.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could gain elevation of privilege on an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

How could an attacker exploit the vulnerability? 
An authenticated attacker could force SQL Server to load a specially crafted file which could cause a buffer overrun, thus corrupting memory in such a way as to allow code execution.

What systems are primarily at risk from the vulnerability? 
All systems where SQL Server is used are at risk from exploitation of this vulnerability.

What does the update do? 
The update removes the vulnerability by validating on-disk files before loading.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued. This security bulletin addresses the privately disclosed vulnerability as well as additional issues discovered through internal investigations.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• An attacker must have valid Windows logon credentials with user permissions to SQL in order to exploit this vulnerability.
• By default, SQL Server 2005 does not run with system privileges.
• By default, SQL Server 2005 prompts the administrator to choose a domain user account during the install. If the installer configured SQL Server 2005 to run as a non-privileged domain account, this domain account could be less impacted by attempts to exploit this vulnerability.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Microsoft has not identified any workarounds for this vulnerability.

What is the scope of the vulnerability? 
An elevation of privilege vulnerability results from the way that SQL Server manages memory in processing the insert statement. This vulnerability could allow an authenticated attacker to run code and take complete control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

What causes the vulnerability? 
SQL Server insufficiently checks insert statements before processing them. As a result, a buffer overrun could result and allow an authenticated attacker to execute code of the attacker’s choice.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could gain elevation of privilege on an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

How could an attacker exploit the vulnerability? 
An authenticated attacker could create insert statements that cause a buffer overrun, thus corrupting memory in such a way as to allow code execution.

What systems are primarily at risk from the vulnerability? 
Systems where SQL Server 2005 is used are primarily at risk.

What does the update do? 
The update removes the vulnerability by validating insert statements.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued. This security bulletin addresses the privately disclosed vulnerability as well as additional issues discovered through internal investigations.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.