Vulnerability Description
Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Data Engine | 1.0 |
| Microsoft | Sql Server | 7.0 |
| Microsoft | Sql Server Desktop Engine | 2000 |
| Microsoft | Sql Server Express Edition | 2005 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/30970
- http://www.securityfocus.com/archive/1/494082/100/0/threaded
- http://www.securityfocus.com/archive/1/516397/100/0/threaded
- http://www.securitytracker.com/id?1020441
- http://www.us-cert.gov/cas/techalerts/TA08-190A.htmlUS Government Resource
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- http://www.vupen.com/english/advisories/2008/2022/references
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-04
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://secunia.com/advisories/30970
- http://www.securityfocus.com/archive/1/494082/100/0/threaded
- http://www.securityfocus.com/archive/1/516397/100/0/threaded
- http://www.securitytracker.com/id?1020441
- http://www.us-cert.gov/cas/techalerts/TA08-190A.htmlUS Government Resource
FAQ
What is CVE-2008-0106?
CVE-2008-0106 is a vulnerability with a CVSS score of 9.0 (HIGH). Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement.
How severe is CVE-2008-0106?
CVE-2008-0106 has been rated HIGH with a CVSS base score of 9.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-0106?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Data Engine, Microsoft Sql Server, Microsoft Sql Server Desktop Engine, Microsoft Sql Server Express Edition.