Buffer overflow in Microsoft Data_engine
CVE-2008-0086
Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to execute arbitrary code via a crafted SQL expression.
Vulnerability class: Buffer Overflow
EPSS: 0.619 (99.1th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Data_engine — versions 1.0
- Microsoft Sql_server — versions 7.0, 2000, 2005
- Microsoft Sql_server_desktop_engine — versions 2000
- Microsoft Sql_server_express_edition — versions 2005
- N/a — versions n/a
Weakness classification (CWE)
References
- secure@microsoft.com (vdb-entry, x_refsource_SECTRACK)
- secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
- secure@microsoft.com (x_refsource_SECUNIA, third-party-advisory)
- secure@microsoft.com (x_refsource_CONFIRM)
- secure@microsoft.com (vdb-entry, x_refsource_VUPEN)
- secure@microsoft.com (x_refsource_MS, vendor-advisory)
- secure@microsoft.com (mailing-list, x_refsource_BUGTRAQ)
- secure@microsoft.com (x_refsource_CONFIRM)
- secure@microsoft.com (US Government Resource, x_refsource_CERT, third-party-advisory)
- secure@microsoft.com (mailing-list, x_refsource_BUGTRAQ)