CVE-2007-4814

published 2007-09-11

CVE-2007-4814: Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.2004.00 in Microsoft SQL Server Enterprise…

Priority P3 52 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.2004.00 in Microsoft SQL Server Enterprise Manager 8.05.2004 allows remote attackers to execute arbitrary code via a long second argument to the Start method.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
microsoft	sql_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename sqldmo.dll↗

path C:\Programmi\Microsoft SQL Server\80\Tools\Binn\sqldmo.dll↗

version sqldmo.dll 2000.80.760.0↗

bytes↗

%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063

bytes↗

%u0D0D%u0D0D

• → The exploit triggers the vulnerability by passing an excessively long string as the second argument (Server) to the Start method of the SQLDMO.SQLServer ActiveX control (progid: SQLDMO.SQLServer). Monitor for ActiveX instantiation of this ProgID in browser or scripting contexts. ↗
• → Heap spray pattern using NOP sled unescape('%u9090%u9090') combined with shellcode is characteristic of this exploit. Detect large repeated 0x9090 blocks in heap memory or script content. ↗
• → The shellcode payload spawns calc.exe as a proof-of-concept; in weaponized variants, monitor for unexpected child processes spawned from browser or script host processes after SQLDMO.SQLServer ActiveX instantiation. ↗
• → The overflow is triggered via the 'Start' method of the SQLServer ActiveX control with a long Server argument. The memberName 'Start' with argCount 4 and an oversized Server string is a reliable detection signature. ↗
• → The heap spray SEH overwrite uses the 0x0D0D0D0D address pattern. Detect 0x0D0D0D0D as a return/SEH address in memory or crash dumps as an indicator of this exploit. ↗

• · The exploit was tested specifically on Windows XP SP2 KR and Windows 2000 Pro SP4 KR with MSDE 2000 sqldmo.dll version 2000.80.760.0; exploitability on other locales or patch levels may differ. ↗
• · The heap spray SEH address (0x0D0D0D0D) is noted as a possible change, meaning attackers may adjust this value for different target environments. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119