SQLXML ISAPI Extension Buffer Overflow Vulnerability

vendor:

SQL Server 2000

by:

SecurityFocus

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: SQL Server 2000

Affected Version From: SQL Server 2000 Gold

Affected Version To: SQL Server 2000 Gold

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

SQLXML ISAPI Extension Buffer Overflow Vulnerability

A buffer overflow issue has been discovered in the SQLXML ISAPI extension that handles data queries over HTTP(SQLXML HTTP). It is possible for a user to initiate the overflow by connecting to a host and submitting malformed data. This issue has been reported to exist in SQL Server 2000 Gold, other versions may be vulnerable as well. IIS-Server/Nwind/Template/catalog.xml?contenttype=text/AAAA...AAA This uses a 'template' file instead of a direct query to cause inetinfo.exe to crash.

Mitigation:

Ensure that the SQLXML ISAPI extension is not enabled on the web server.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5004/info

SQLXML is a component of SQL Server 2000, which enables SQL servers to receive and send database queries via XML (Extensible Markup Language) format. Such queries can be sent using various methods of communication, one of which is via HTTP. SQLXML HTTP components reside in a virtual directory on a web server and are not enabled by default, SQLXML ISAPI extensions run with LocalSystem privileges.

A buffer overflow issue has been discovered in the SQLXML ISAPI extension that handles data queries over HTTP(SQLXML HTTP).

It is possible for a user to initiate the overflow by connecting to a host and submitting malformed data.

This issue has been reported to exist in SQL Server 2000 Gold, other versions may be vulnerable as well. 

IIS-Server/Nwind/Template/catalog.xml?contenttype=text/AAAA...AAA

This uses a 'template' file instead of a direct query to cause inetinfo.exe to crash.