CVE-2008-5416
Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 87.0%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka "SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability."
- CVSS 2.0
- 9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C
- EPSS
- 87.04% probability · 100th percentile
- Public exploits
- 3 in Exploit-DB · verified · first 17 December 2008
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- microsoft/sql server
- Source
- cve@mitre.org
EPSS 87.0% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
Public exploits (3)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
| EDB-ID | Title | Type | Published | Verified |
|---|---|---|---|---|
| EDB-16396source ↗ | Microsoft SQL Server - sp_replwritetovarbin Memory Corruption (MS09-004) (via SQL Injection) (Metasploit)windows · Metasploit | remote | 8 February 2011 | yes |
| EDB-16392source ↗ | Microsoft SQL Server - sp_replwritetovarbin Memory Corruption (MS09-004) (Metasploit)windows · Metasploit | remote | 24 January 2011 | yes |
| EDB-7501source ↗ | Microsoft SQL Server - 'sp_replwritetovarbin()' Heap Overflowwindows · Guido Landi | local | 17 December 2008 | yes |
References
- http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.html
- http://osvdb.org/50917
- http://secunia.com/advisories/33034Vendor Advisory
- http://securityreason.com/securityalert/4706
- http://securitytracker.com/id?1021363
- http://securitytracker.com/id?1021490
- http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm
- http://www.kb.cert.org/vuls/id/696644US Government Resource
- http://www.microsoft.com/technet/security/advisory/961040.mspx
- http://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txtExploit
- http://www.securityfocus.com/archive/1/499042/100/0/threaded
- http://www.securityfocus.com/archive/1/499085/100/0/threaded
- http://www.securityfocus.com/archive/1/516397/100/0/threaded
- http://www.securityfocus.com/bid/32710Exploit
- http://www.us-cert.gov/cas/techalerts/TA09-041A.htmlUS Government Resource
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- http://www.vupen.com/english/advisories/2008/3380
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47182
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6217
- https://www.exploit-db.com/exploits/7501
- http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.html
- http://osvdb.org/50917
- http://secunia.com/advisories/33034Vendor Advisory
- http://securityreason.com/securityalert/4706
- http://securitytracker.com/id?1021363
- http://securitytracker.com/id?1021490
- http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm
- http://www.kb.cert.org/vuls/id/696644US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.