Buffer overflow in Microsoft SQL Server

CVE-2008-4110

Buffer overflow in the SQLVDIRLib.SQLVDirControl ActiveX control in Tools\Binn\sqlvdir.dll in Microsoft SQL Server 2000 (aka SQL Server 8.0) allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a long URL in the second argument to the Connect method. NOTE: this issue is not a vulnerability in many environments, since the control is not marked as safe for scripting and would not execute with default Internet Explorer settings.

Vulnerability class: Buffer Overflow

EPSS: 0.184 (96.9th percentile) — read the EPSS interpretation.

Affected products

Microsoft Sql_server — versions 2000
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (x_refsource_SREASON, third-party-advisory)
cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)