Launch Printer Friendly Page Security TechCenter > Security Bulletins > Microsoft Security Bulletin MS09-004

Microsoft Security Bulletin MS09-004 - Important

Vulnerability in Microsoft SQL Server Could Allow Remote Code Execution (959420)

Published: | Updated:

Version: 1.2

General Information

Executive Summary

This security update resolves a privately reported vulnerability in Microsoft SQL Server. The vulnerability could allow remote code execution if untrusted users access an affected system or if a SQL injection attack occurs to an affected system. Systems with SQL Server 7.0 Service Pack 4, SQL Server 2005 Service Pack 3, and SQL Server 2008 are not affected by this issue.

This security update is rated Important for supported releases of SQL Server 2000, SQL Server 2005 Service Pack 2, Microsoft SQL Server 2000 Desktop Engine (MSDE 2000), SQL Server 2005 Express Edition, Microsoft SQL Server 2000 Desktop Engine (WMSDE), and Windows Internal Database (WYukon). For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerability by validating input parameters passed to an extended stored procedure. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

This security update also addresses the vulnerability first described in Microsoft Security Advisory 961040.

Recommendation. Microsoft recommends that customers apply the update at the earliest opportunity.

Known Issues. Microsoft Knowledge Base Article 959420 documents the currently known issues that customers may experience when installing this security update. The article also documents recommended solutions for these issues.

Affected and Non-Affected Software

The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.

SQL Server

GDR Software UpdatesQFE Software UpdatesMaximum Security ImpactAggregate Severity RatingBulletins Replaced by this Update
SQL Server 2000 Service Pack 4
(KB960082)
SQL Server 2000 Service Pack 4
(KB960083)
Remote Code ExecutionImportantMS08-040
SQL Server 2000 Itanium-based Edition Service Pack 4
(KB960082)
SQL Server 2000 Itanium-based Edition Service Pack 4
(KB960083)
Remote Code ExecutionImportantMS08-040
SQL Server 2005 Service Pack 2
(KB960089)
SQL Server 2005 Service Pack 2
(KB960090)
Remote Code ExecutionImportantMS08-052
SQL Server 2005 x64 Edition Service Pack 2
(KB960089)
SQL Server 2005 x64 Edition Service Pack 2
(KB960090)
Remote Code ExecutionImportantMS08-052
SQL Server 2005 with SP2 for Itanium-based Systems
(KB960089)
SQL Server 2005 with SP2 for Itanium-based Systems
(KB960090)
Remote Code ExecutionImportantMS08-052
Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) Service Pack 4
(KB960082)
Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) Service Pack 4
(KB960083)
Remote Code ExecutionImportantMS08-040
SQL Server 2005 Express Edition Service Pack 2
(KB960089)
SQL Server 2005 Express Edition Service Pack 2
(KB960090)
Remote Code ExecutionImportantMS08-052
SQL Server 2005 Express Edition with Advanced Services Service Pack 2
(KB960089)
SQL Server 2005 Express Edition with Advanced Services Service Pack 2
(KB960090)
Remote Code ExecutionImportantMS08-052

Windows Components

Operating SystemComponentMaximum Security ImpactAggregate Severity RatingBulletins Replaced by this Update
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2Microsoft SQL Server 2000 Desktop Engine (WMSDE)
(KB960082)
Remote Code ExecutionImportantMS08-040
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2Windows Internal Database (WYukon) Service Pack 2
(KB960089)
Remote Code ExecutionImportantMS08-040
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2Microsoft SQL Server 2000 Desktop Engine (WMSDE)
(KB960082)
Remote Code ExecutionImportantMS08-040
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2Windows Internal Database (WYukon) x64 Edition Service Pack 2
(KB960089)
Remote Code ExecutionImportantMS08-040
Windows Server 2008 for 32-bit Systems*Windows Internal Database (WYukon) Service Pack 2
(KB960089)
Remote Code ExecutionImportantMS08-040
Windows Server 2008 for x64-based Systems* Windows Internal Database (WYukon) x64 Edition Service Pack 2
(KB960089)
Remote Code ExecutionImportantMS08-040

*Windows Server 2008 server core installation affected. For supported editions of Windows Server 2008, this update applies, with the same severity rating, whether or not Windows Server 2008 was installed using the Server Core installation option. For more information on this installation option, see Server Core. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.

Non-Affected Software

SoftwareComponent
SQL Server 7.0 Service Pack 4Not applicable
Microsoft Data Engine (MSDE) 1.0 Service Pack 4Not applicable
SQL Server 2005 Service Pack 3Not applicable
Application Center 2000 Service Pack 2Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) Service Pack 3a
SQL Server 2005 x64 Edition Service Pack 3Not applicable
SQL Server 2005 with SP3 for Itanium-based SystemsNot applicable
SQL Server 2008 (32-bit editions)Not applicable
SQL Server 2008 (x64-based editions)Not applicable
SQL Server 2008 (Itanium-based editions)Not applicable

Frequently Asked Questions (FAQ) Related to This Security Update

Vulnerability Information

Severity Ratings and Vulnerability Identifiers

SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability - CVE-2008-5416

Update Information

Detection and Deployment Tools and Guidance

Security Update Deployment

Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

  • Bernhard Mueller of SEC Consult Vulnerability Lab for reporting the SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability (CVE-2008-5416)

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections Web sites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Support

  • Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.
  • International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (February 10, 2009): Bulletin published.
  • V1.1 (March 5, 2009): Added entry to section, Frequently Asked Questions (FAQ) Related to This Security Update, announcing a detection logic change to the update packages for Microsoft SQL Server 2000 Desktop Engine (WMSDE) (KB960082). This is a deployment change only that does not affect the files contained in the initial update. Customers who have successfully updated their systems do not need to reinstall this update.
  • V1.2 (March 18, 2009): Corrected product instance names from "ADMT" and "ADS" to "MS_ADMT" and "MicrosoftADS", respectively. These are instance names referenced in the Security Update Deployment section for the Microsoft SQL Server 2000 Desktop Engine (WMSDE). This is an informational change only that does not affect the files contained in the update. Customers who have successfully updated their systems do not need to reinstall this update.