NGSSoftware Insight Security Research Advisory Name: BULK INSERT Buffer Overflow Systems Affected: Microsoft SQL Server 2000 Severity: Medium Category: Buffer Overrun Vendor URL: http://www.microsoft.com/ Authors: Mark Litchfield (markat_private) Advisory URL: http://www.ngssoftware.com/advisories/ms-sqlbi.txt Date: 11th July 2002 Advisory number: #NISR11072002 VNA Reference: http://www.nextgenss.com/vna/ms-sql.txt [Please note that this advisory relates to one of the issues discussed in the SQL Server VNA. There are still more to be fixed.] Description *********** Microsoft's SQL Server 2000 contains functionality that allows a database owner to populate a table with data with one fell swoop using the 'BULK INSERT' query. This functionality contains a remotely exploitable buffer overrun vulnerability that can be exploited by an attacker to run arbitrary code. Details ******* The 'BULK INSERT' query will take a user supplied file name and insert the contents of this file into a specified table. By supplying an overly long filename to the query, a buffer is overflowed and the saved return address stored on the stack is overwritten. This allows the attacker to gain control over the process' execution. SQL Server 2000 can be run in the security context of a domain account or LOCAL SYSTEM, so depending upon the particular setup, an attacker may be able to gain complete control over the vulnerable system. To be able to use the 'BULK INSERT' query one must have the privileges of the database owner or dbo. Note this does not necessarily imply 'sa' equivalence. Another point to note is that whilst this overflow is 'UNICODE' in nature by supplying code as a UNICODE string exploitation is made easier. Fix Information *************** NGSSoftware alerted Microsoft to this problem on the 28th May 2002. Microsoft have created a patch. Please see their bulletin for more details: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/ bulletin/MS02-034.asp Whilst NGSSoftware rate this as a medium risk issue, we still urge customers to apply the patch as soon as is possible as it contains fixes for other issues such as a buffer overflow in the pwdencrypt() function. Further Information ******************* For further information about the scope and effects of buffer overflows, please see http://www.ngssoftware.com/papers/non-stack-bo-windows.pdf http://www.ngssoftware.com/papers/ntbufferoverflow.html http://www.ngssoftware.com/papers/bufferoverflowpaper.rtf http://www.ngssoftware.com/papers/unicodebo.pdf
This archive was generated by hypermail 2b30 : Thu Jul 11 2002 - 07:50:19 PDT