CVE-2008-5416
Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server...
- Published
- Dec 10, 2008
- Updated
- Aug 7, 2024
- Assigning CNA
- mitre
- Evidence observed
- Dec 17, 2008
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:L/Au:S/C:C/I:C/A:CHigh · next 30 days
- Percentile
- 99.7%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka "SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability."
Sources
modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin.rb
Metasploit Framework modulesDeclared conditions
- platform: Windows($.exploit_windows/mssql/ms09_004_sp_replwritetovarbin.platform)
- verification: check_declared($.exploit_windows/mssql/ms09_004_sp_replwritetovarbin.check)
modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin_sqli.rb
Metasploit Framework modulesDeclared conditions
- platform: Windows($.exploit_windows/mssql/ms09_004_sp_replwritetovarbin_sqli.platform)
- verification: check_declared($.exploit_windows/mssql/ms09_004_sp_replwritetovarbin_sqli.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.