[NT] MSDE, SQL Server 7 & 2000 Adhoc Heterogeneous Queries Buffer Overflow and DoS

From: support@securiteam.com
Date: 02/24/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Sun, 24 Feb 2002 00:51:58 +0100 (CET)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  MSDE, SQL Server 7 & 2000 Adhoc Heterogeneous Queries Buffer Overflow and
DoS
------------------------------------------------------------------------

SUMMARY

A distributed query may access data from multiple heterogeneous data
sources, which can be stored either in the same or in a different
computer. Microsoft SQL Server supports distributed queries by using OLE
DB, the Microsoft specification of an application-programming interface
(API) for universal data access. Distributed queries provide SQL Server
users with access to:
 - Distributed data stored in multiple computers that are running SQL
Server.
 - Heterogeneous data stored in various relational and non-relational data
sources that can be accessed using an OLE DB provider.

You can reference heterogeneous OLE DB data sources in Transact-SQL
statements by:
 - Linked servers , OpenQuery function.
 - OpenDataSource and OpenRowset functions.

OpenDataSource and OpenRowset functions are accessible to all users and
contain an unchecked buffer in one of its parameters. The buffer overflow
and DoS problem occur when an overly long string is supplied in the
"provider name" parameter.

DETAILS

Vulnerable systems:
MSDE, SQL Server 7, SQL Server 2000 with all service packs and fixes
applied.

In SQL Server 7 overflow starts at character number 6819 and if the amount
of characters is >= 6918 the server will crash:

SELECT * FROM OpenDataSource('XXXXXXXXXXX...' ---> 6819 characters or
more,'')...nothing

SELECT * FROM OPENROWSET('XXXXXXXXXXX...' ---> 6819 characters or
more,'','')

In SQL Server 2000 overflow starts at character number 6887 and if the
amount of characters is >= 6998 the server will crash:

SELECT * FROM OpenDataSource('XXXXXXXXXXX...' ---> 6887 characters or
more,'')...nothing

SELECT * FROM OPENROWSET('XXXXXXXXXXX...' ---> 6887 characters or
more,'','')

ADDITIONAL INFORMATION

The information has been provided by <mailto:cesarc56@yahoo.com> c c.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • Re: Conversion error
    ... text (character strings) before importing them into SQL ... I have defined all columns in the SQL Server ... all values properly to varchar. ... money data. ...
    (microsoft.public.sqlserver.dts)
  • RE: strange problem with sql
    ... The difference in the character _ and W is just one bit. ... There are other letters that are getting mistranslated: ... My onlly guess now is that there is a memory ... > that at one occassion the SQL Server executed was changed on one ...
    (microsoft.public.data.ado)
  • Re: BULK COPY changes row order importing Text file
    ... Error = [ODBC SQL Server Driver]Invalid character value for cast ... BCP copy in failed ...
    (microsoft.public.sqlserver.programming)
  • RE: strange problem with sql
    ... The difference in the character _ and W is just one bit. ... There are other letters that are getting mistranslated: ... My onlly guess now is that there is a memory ... > that at one occassion the SQL Server executed was changed on one ...
    (microsoft.public.sqlserver.programming)
  • Re: Newbie performance/design question
    ... > character. ... just need to speed up this particular query, ... Pro SQL Server 2000 Database Design - ... > My first thought is to create a new field composed of the above,> concatenated together and separated by perhaps a '|' vertical bar ...
    (microsoft.public.sqlserver.programming)