CVE-2008-5416
published 2008-12-10CVE-2008-5416: Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005…
PriorityP272critical9CVSS 2.0
AVNACLAuSCCICAC
EXPLOIT
EPSS
87.04%
99.8th percentile
Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka "SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability."
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | sql_server | — | — |
| microsoft | sql_server | — | — |
| vmware | esxi | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_vcenter_server | — | — |
| vmware | vmware_vsphere | — | — |
| vmware | vmware_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x81\xc4\xf0\xef\xff\xff
- →Monitor SQL Server audit logs and network traffic for sp_replwritetovarbin invocations, especially from non-replication accounts or via SQL injection vectors. ↗
- →Snort/IDS rules were released on 2008-12-11 specifically to detect exploitation of CVE-2008-5416; reference VRT advisory vrt-rules-2008-12-11 for rule content. ↗
- →The exploit uses a PrependEncoder stub (\x81\xc4\xf0\xef\xff\xff — ADD ESP,-4112) prepended to shellcode; scanning SQL Server payloads for this byte sequence can identify exploit attempts. ↗
- →The exploit targets TCP port 1433 (default MSSQL) and uses UDP port 1434 for fingerprinting; anomalous UDP 1434 probes followed by TCP 1433 sp_replwritetovarbin calls are a strong indicator. ↗
- →The exploit payload space is 512 bytes with EXITFUNC=seh; look for SEH-based shellcode patterns in MSSQL TDS streams following sp_replwritetovarbin calls. ↗
- ·Exploitation requires an authenticated database session; however, the vulnerability can also be reached via SQL injection, lowering the effective authentication barrier. ↗
- ·The MSSQL server service does not automatically restart by default after a crash; a failed exploit that crashes the service before stack hijack will result in a persistent DoS. ↗
- ·Microsoft silently patched this vulnerability in SQL Server 2005 SP3 before the public MS09-004 advisory; environments on SP3 may already be protected without explicit patch awareness. ↗
- ·The Metasploit SQL-injection variant (ms09_004_sp_replwritetovarbin_sqli) uses automatic target detection and ROP chains entirely within sqlservr.exe address space, making it highly reliable across multiple SP levels. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qhrx-q7mr-q5x7: Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8
ghsa_unreviewed·2022-05-14
CVE-2008-5416 [HIGH] CWE-119 GHSA-qhrx-q7mr-q5x7: Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8
Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka "SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability."
VMware
Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
vendor_vmware·2011-02-10·CVSS 5.0
CVE-2008-0085 [MEDIUM] Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
VMSA-2011-0003: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX VMware Security Advisory VMware Security Advisory Advisory ID: VMware Security Advisory Synopsis: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX VMware Security Advisory Issue date: VMware Security Advisory Updated on: VMware Security Advisory CVE numbers:
CVEs: CVE-2008-0085, CVE-2008-0086, CVE-2008-0106, CVE-2008-0107, CVE-2008-3825, CVE-2008-5416, CVE-2009-1384, CVE-2009-2693, CVE-2009-2901, CVE-2009-2902, CVE-2009-3548, CVE-2009-3555, CVE-2009-4308, CVE-2010-0003, CVE-2010-0007, CVE-2010-0008, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085,
No detection rules found.
Exploit-DB
Microsoft SQL Server - sp_replwritetovarbin Memory Corruption (MS09-004) (via SQL Injection) (Metasploit)
exploitdb·2011-02-08
CVE-2008-5416 Microsoft SQL Server - sp_replwritetovarbin Memory Corruption (MS09-004) (via SQL Injection) (Metasploit)
Microsoft SQL Server - sp_replwritetovarbin Memory Corruption (MS09-004) (via SQL Injection) (Metasploit)
---
##
# $Id: ms09_004_sp_replwritetovarbin_sqli.rb 11730 2011-02-08 23:31:44Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection',
'Description' => %q{
A heap-based buffer overflow can occur when calling the undocumented
"sp_replwritetovarbin" extended stored procedure. This vulnerability affects
all versions of Microsoft SQL Server 2000 and 2005, Window
Exploit-DB
Microsoft SQL Server - sp_replwritetovarbin Memory Corruption (MS09-004) (Metasploit)
exploitdb·2011-01-24
CVE-2008-5416 Microsoft SQL Server - sp_replwritetovarbin Memory Corruption (MS09-004) (Metasploit)
Microsoft SQL Server - sp_replwritetovarbin Memory Corruption (MS09-004) (Metasploit)
---
##
# $Id: ms09_004_sp_replwritetovarbin.rb 11631 2011-01-24 19:37:58Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft SQL Server sp_replwritetovarbin Memory Corruption',
'Description' => %q{
A heap-based buffer overflow can occur when calling the undocumented
"sp_replwritetovarbin" extended stored procedure. This vulnerability affects
all versions of Microsoft SQL Server 2000 and 2005, Windows Internal Database,
and Microsoft Desktop
Exploit-DB
Microsoft SQL Server - 'sp_replwritetovarbin()' Heap Overflow
exploitdb·2008-12-17
CVE-2008-5416 Microsoft SQL Server - 'sp_replwritetovarbin()' Heap Overflow
Microsoft SQL Server - 'sp_replwritetovarbin()' Heap Overflow
---
# milw0rm.com [2008-12-17]
Metasploit
MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection
metasploit
MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection
MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection
A heap-based buffer overflow can occur when calling the undocumented "sp_replwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows Internal Database, and Microsoft Desktop Engine (MSDE) without the updates supplied in MS09-004. Microsoft patched this vulnerability in SP3 for 2005 without any public mention. This exploit smashes several pointers, as shown below. 1. pointer to a 32-bit value that is set to 0 2. pointer to a 32-bit value that is set to a length influenced by the buffer length. 3. pointer to a 32-bit value that is used as a vtable pointer. In MSSQL 2000, this value is referenced with a displacement of 0x38. For MSSQL
Metasploit
MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption
metasploit
MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption
MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption
A heap-based buffer overflow can occur when calling the undocumented "sp_replwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows Internal Database, and Microsoft Desktop Engine (MSDE) without the updates supplied in MS09-004. Microsoft patched this vulnerability in SP3 for 2005 without any public mention. An authenticated database session is required to access the vulnerable code. That said, it is possible to access the vulnerable code via an SQL injection vulnerability. This exploit smashes several pointers, as shown below. 1. pointer to a 32-bit value that is set to 0 2. pointer to a 32-bit value that is set to a length influenced by the buffe
arXiv
Integrating Network and Attack Graphs for Service-Centric Impact Analysis
arxiv_fulltext·2026-02-11
Integrating Network and Attack Graphs for Service-Centric Impact Analysis
Integrating Network and Attack Graphs for Service-Centric Impact Analysis
Joni Herttuainene1
Vesa Kuikka
Kimmo K. Kaski
e1e-mail: [email protected]
Department of Computer Science, Aalto University School of Science,
P.O. Box 11000, 00076 Aalto, Finland
Received: date / Accepted: date
## Abstract
We present a novel methodology for modelling, visualising, and analysing cyber threats, attack paths, as well as their impact on user services in enterprise or infrastructure networks of digital devices and services they provide. Using probabilistic methods to track the propagation of an attack through attack graphs, via the service or application layers, and on physical communication networks, our model enables us to analyse cyber attacks at different levels of detail. Understanding
Talos
Out of band Microsoft Security Advisory for Internet Explorer CVE-2008-4844 and SQL Server vulnerability CVE-2008-5416
blogs_talos·2008-12-11·CVSS 9.3
CVE-2008-4844 [CRITICAL] Out of band Microsoft Security Advisory for Internet Explorer CVE-2008-4844 and SQL Server vulnerability CVE-2008-5416
## Out of band Microsoft Security Advisory for Internet Explorer CVE-2008-4844 and SQL Server vulnerability CVE-2008-5416
Today, Microsoft released a security advisory for Internet Explorer. Microsoft SQL server also has a problem with a stored procedure. In response, we released some new rules to detect attacks against these two products. Details on the rules are here http://www.snort.org/vrt/advisories/vrt-rules-2008-12-11.html .
Talos
Out of band Microsoft Security Advisory for Internet Explorer CVE-2008-4844 and SQL Server vulnerability CVE-2008-5416
blogs_talos·2008-12-11·CVSS 9.3
[CRITICAL] Out of band Microsoft Security Advisory for Internet Explorer CVE-2008-4844 and SQL Server vulnerability CVE-2008-5416
Today, Microsoft released a security advisory for Internet Explorer. Microsoft SQL server also has a problem with a stored procedure. In response, we released some new rules to detect attacks against these two products. Details on the rules are here http://www.snort.org/vrt/advisories/vrt-rules-2008-12-11.html.
http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.htmlhttp://osvdb.org/50917http://secunia.com/advisories/33034http://securityreason.com/securityalert/4706http://securitytracker.com/id?1021363http://securitytracker.com/id?1021490http://support.avaya.com/elmodocs2/security/ASA-2009-055.htmhttp://www.kb.cert.org/vuls/id/696644http://www.microsoft.com/technet/security/advisory/961040.mspxhttp://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txthttp://www.securityfocus.com/archive/1/499042/100/0/threadedhttp://www.securityfocus.com/archive/1/499085/100/0/threadedhttp://www.securityfocus.com/archive/1/516397/100/0/threadedhttp://www.securityfocus.com/bid/32710http://www.us-cert.gov/cas/techalerts/TA09-041A.htmlhttp://www.vmware.com/security/advisories/VMSA-2011-0003.htmlhttp://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.htmlhttp://www.vupen.com/english/advisories/2008/3380https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004https://exchange.xforce.ibmcloud.com/vulnerabilities/47182https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6217https://www.exploit-db.com/exploits/7501http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.htmlhttp://osvdb.org/50917http://secunia.com/advisories/33034http://securityreason.com/securityalert/4706http://securitytracker.com/id?1021363http://securitytracker.com/id?1021490http://support.avaya.com/elmodocs2/security/ASA-2009-055.htmhttp://www.kb.cert.org/vuls/id/696644http://www.microsoft.com/technet/security/advisory/961040.mspxhttp://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txthttp://www.securityfocus.com/archive/1/499042/100/0/threadedhttp://www.securityfocus.com/archive/1/499085/100/0/threadedhttp://www.securityfocus.com/archive/1/516397/100/0/threadedhttp://www.securityfocus.com/bid/32710http://www.us-cert.gov/cas/techalerts/TA09-041A.htmlhttp://www.vmware.com/security/advisories/VMSA-2011-0003.htmlhttp://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.htmlhttp://www.vupen.com/english/advisories/2008/3380https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004https://exchange.xforce.ibmcloud.com/vulnerabilities/47182https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6217https://www.exploit-db.com/exploits/7501
2008-12-10
Published