CVE-2008-5416
HighSummary
W Microsoft SQL Server 2000 SP4 oraz wcześniejszych wersjach, a także w SQL Server 2005 SP2, występuje podatność na przepełnienie bufora w stercie. Umożliwia to zdalnym, uwierzytelnionym użytkownikom wywołanie wyjątku naruszenia dostępu lub wykonanie dowolnego kodu poprzez wywołanie procedury składowanej sp_replwritetovarbin z nieprawidłowymi parametrami.
Risk Assessment
Podatność ta może prowadzić do odmowy usługi lub zdalnego wykonania kodu, co stwarza poważne zagrożenie dla integralności i dostępności systemu. Organizacje mogą być narażone na ataki, które mogą prowadzić do utraty danych lub nieautoryzowanego dostępu.
Recommendation
Zaleca się aktualizację do najnowszej wersji SQL Server, aby usunąć tę podatność. Należy również ograniczyć dostęp do procedur składowanych oraz monitorować logi w celu wykrycia potencjalnych prób wykorzystania tej luki.
Related vulnerabilities
- CVE-2026-47839Critical
A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.
- CVE-2026-14563Critical
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.
- CVE-2026-14560Critical
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.
- CVE-2026-14559Critical
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.
- CVE-2026-8778Critical
The MIPL Grouped Checkout Fields for WooCommerce plugin for WordPress (versions up to and including 1.2.1) is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function. This allows unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution.
- CVE-2026-82107Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authentication flaw that allows a remote authenticated attacker to obtain sensitive information and bypass security restrictions.
- CVE-2026-82100Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a path traversal issue that allows a remote authenticated attacker to cause a denial of service.
- CVE-2026-81204Critical
IBM Langflow OSS versions 1.0.0 through 1.11.5 allow a remote attacker to execute arbitrary code due to code injection during graph construction.
- CVE-2026-80424Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.
- CVE-2026-79724Critical
IBM Langflow OSS versions 1.0.0 through 1.11.5 allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.
Original NVD description (English source)
Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka "SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability."