CVE-2008-0107
08.07.2008, 23:41
Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 allows remote authenticated users to execute arbitrary code via a (1) SMB or (2) WebDAV pathname for an on-disk file (aka stored backup file) with a crafted record size value, which triggers a heap-based buffer overflow, aka "SQL Server Memory Corruption Vulnerability."Enginsight
| Vendor | Product | Version |
|---|---|---|
| microsoft | data_engine | 1.0:sp4 |
| microsoft | sql_server | 7.0:sp4 |
| microsoft | wyukon | * |
| microsoft | wyukon | * |
| microsoft | wyukon | * |
| microsoft | wyukon | * |
| microsoft | windows_server_2008 | * |
| microsoft | windows_server_2008 | * |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References