Vulnerability Note VU#696644

Microsoft SQL Server fails to properly validate parameters to the sp_replwritetovarbin extended stored procedure

In order to access sp_replwritetovarbin, an attacker would need to authenticate to the database first. A separate SQL injection vulnerability in a web application could allow a remote, unauthenticated attacker to exploit the sp_replwritetovarbin vulnerability with the user credentials of the web application. Microsoft Security Advisory (954462) provides detection and mitigation advice for SQL injection vulnerabilities.

Exploit code is publicly available for this vulnerability.

II. Impact

This issue is addressed in Microsoft Security Bulletin MS09-004.
Workarounds

Deny execute permissions on sp_replwritetovarbin as described in Microsoft Security Bulletin MS09-004.

Alternatively, remove sp_replwritetovarbin using sp_dropextendedproc as described in SEC Consult Security Advisory < 20081209-0 > and "Removing an Extended Stored Procedure from SQL Server."

Removing execute permissions or removing sp_replwritetovarbin may impact application functionality.

Systems Affected

http://www.sec-consult.com/files/20081209_mssql-sp_replwritetovarbin_memwrite.txt
http://www.milw0rm.com/exploits/7501
http://www.microsoft.com/technet/security/advisory/961040.mspx
http://msdn.microsoft.com/en-us/library/aa215995(SQL.80).aspx
http://msdn.microsoft.com/en-us/library/aa933290(SQL.80).aspx
http://www.microsoft.com/technet/security/advisory/954462.mspx
http://www.microsoft.com/technet/security/bulletin/ms09-004.mspx

Credit

This vulnerability was reported by Bernhard Mueller of SEC Consult Vulnerability Lab.

This document was written by Chad R Dougherty and Art Manion.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.