CVE-2008-0086

Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to execute arbitrary code via a crafted SQL expression.

Score

CVSS 2.0 9.0 Critical

Status

Modified - secure@microsoft.com

Published

2008-07-08

Last modified

2024-08-07

Weaknesses

CWE-119

Affected products

• Data Engine (Microsoft)
• Sql Server (Microsoft)
• Sql Server Desktop Engine (Microsoft)
• Sql Server Express Edition (Microsoft)

References

• http://secunia.com/advisories/30970
• http://www.securityfocus.com/archive/1/494082/100/0/threaded
• http://www.securityfocus.com/archive/1/516397/100/0/threaded
• http://www.securitytracker.com/id?1020441
• http://www.us-cert.gov/cas/techalerts/TA08-190A.html
• http://www.vmware.com/security/advisories/VMSA-2011-0003.html
• http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
• http://www.vupen.com/english/advisories/2008/2022/references
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-040
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14052