@stake advisory: Multiple overflow and format string vulnerabilities in in Microsoft SQL Server

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                           @stake, Inc.
                         www.atstake.com
                        Security Advisory

Advisory Name: Multiple overflow and format string vulnerabilities
in Microsoft SQL Server
Release Date: 12/20/2001
Application: Microsoft SQL Server 7.0 and 2000
Platform: Microsoft Windows NT 4.0, 2000, XP
Severity: A user of the database can execute arbitrary code
or cause a denial of service to the server
Author: Chris Anley [[email protected]]
Chris Wysopal [[email protected]]
Vendor Status: Vendor has bulletin and patch
CVE Candidate: CAN-2001-0542
Reference: www.atstake.com/research/advisories/2001/a122001-1.txt

Overview:

This advisory describes multiple vulnerabilities in Microsoft SQL Server
7.0 and 2000 that allow an attacker to run arbitrary code on the SQL
Server in the context of the account that SQL Server is running under
(normally an administrator).

A common attack scenario is to use web application vulnerabilities to
send arbitrary queries to a backend SQL Server that is otherwise
protected from direct attack via the internet. More information
detailing this type of attack, known as SQL Command Injection, is
available at: http://www.owasp.org/projects/asac/iv-sqlinjection.shtml

Description:

SQL Server provides built-in functions for the formatting of error
messages based on c - style format specifiers. These built-in functions
are accessible to all users. Providing maliciously crafted input to these
functions results in exploitable error conditions in the SQL Server
process. To mount this attack the attacker must have permission to
execute SQL queries either directly or by leveraging SQL Command
Injection flaws.

The raiserror() function is accessible to all users, and permits the
specification of an overly long length specifier. This results in an
exploitable overflow. Additionally, format string specifiers can be used,
enabling an attacker to overwrite an arbitrary address in memory.
This can result in the execution of arbitrary code.

The formatmessage() built in function is accessible to all users. By
creating specifically crafted messages any user can subsequently
cause malicious code contained in the message to be executed.

The xp_sprintf extended stored procedure (which is accessible to the
'public' role by default) permits the specification of overly long
length specifiers. This results in an exploitable overflow.

Vendor Response:

The vendor has issued a bulletin on this issue:

http://www.microsoft.com/technet/security/bulletin/MS01-060.asp

The vendor had made patches available:

SQL Server:

     SQL Server 7.0:
     http://www.microsoft.com/Downloads/Release.asp?ReleaseID=34131
    SQL Server 2000:
     http://www.microsoft.com/Downloads/Release.asp?ReleaseID=34131

C Runtime:

     Windows NT 4.0:
     http://www.microsoft.com/Downloads/Release.asp?ReleaseID=33500
    Windows 20000:
     http://www.microsoft.com/Downloads/Release.asp?ReleaseID=33500
    Windows XP:
     http://www.microsoft.com/Downloads/Release.asp?ReleaseID=35023

Recommendations:

Apply the vendor patches.

Do not permit direct connections to SQL Server by untrusted users.
This can be achieved by:

Removing all unused connection 'protocols' using the SQL Server Network
Utility

Using network packet filtering devices such as a firewall

Configuring Windows 2000 IP Security filters on the SQL Server to permit
only trusted connections

If the SQL Server is being connected to from an application server or web
server farm, ensure that appropriate server side input validation is in
place. Specifically, ensure that users cannot insert SQL commands into
input data by specifying the ' character (among others). Countermeasures
are detailed here: http://www.owasp.org/projects/asac/iv-sqlinjection.shtml

Essentially, the aim is to permit only input that is explicitly known to
be 'good' and reject all other input.

Common Vulnerabilities and Exposures (CVE) Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues. These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.

    SQL Server vulnerability: CAN-2001-0542

For more advisories: http://www.atstake.com/research/advisories/
PGP Key: http://www.atstake.com/research/pgp_key.asc

Copyright 2001 @stake, Inc. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0

iQA/AwUBPCKPbFESXwDtLdMhEQLCKACfbw6HdKBcKhvzwVQGFeGPwgk75XEAnA2r
H+zCiK4j9eoXz9PiJ7xYLSuN
=nR71
-----END PGP SIGNATURE-----