img by Coba

A SQL Server Security Hole “Could Allow Remote Code Execution”

The skinny: apparently back in April, SEC Consult notified the MSFT team of a vulnerability in the sp_replwritetovarbin system stored procedure. Microsoft has thus far declined to create a patch and so, for whatever reason, SEC Consult decided to release the vulnerability publicly. You can view the scripts to reproduce here but beware - this script will likely cause unexpected behavior (so don't run it on production).

I tested this the scripts they provided to reproduce the vulnerability against a 9.0.3282 test server (that's SQL Server 2005 SP2 with CU9) and it said, "Command(s) completed successfully." I was just about ready to dismiss it -- "Ha! MSFT must've already patched it!" and then I clicked the Execute button once more - BAM! (as that cajun chef on TV always says). It throws two errors: "Msg 0, Level 11, State 0, Line 0 A severe error occurred on the current command.  The results, if any, should be discarded."

image

When I looked in the Windows Application Event log, it says "A user request from the session with SPID 55 generated a fatal exception. SQL Server is terminating this session. Contact Product Support Services with the dump produced in the log directory."

image

On my machine, this did not cause any decreased/change-in functionality with SQL Server; just unpredictable results. The report says that it will trigger an access violation exception (write to address 0x41414141). Sure enough, when I look at exception.log in my SQL Server's log directory, it throws that error:

image

Strangely enough, you can play around with the script and SQL Server will not provide an error. I added a SELECT statement at the end of the vulnerability query and SQL Server did nothing - no error, nothing but a welcoming Command(s) completed successfully. If I put a GO in between the vulnerability code and my SELECT statement, I received errors every single time I executed the code (remember that before I didn't receive an error the first time). In fact, with no other commands, here's the reproducibility:

  1. Run the vulnerability code as-is multiple times - receive an error every even-numbered execution (1st, 3rd, 5th executions generates no error but 2nd, 4th, and 6th do)
  2. Run the vulnerability with a SELECT attached at end - no errors ever
  3. Run the vulnerability with a GO followed by a SELECT at end - error every time

Microsoft Responds

Microsoft was finally persuaded to release a Security Advisory yesterday (here) after SEC Consult's public release of the code to repro the vulnerability. I love the first line - "Microsoft is investigating new public reports of a vulnerability that could allow remote code execution on systems with supported editions of Microsoft SQL Server..." Notice that phrasing "new public reports"? Yeah - SEC Consult told them about in April but only made the vulnerability public on December 9. Thankfully SQL 2008 and SQL Server 2005 SP3 are not affected.

Wait - SQL Server 2005 SP3 is not affected? Waiiiiit a minute! That must mean that MSFT had the fix, tested it so thoroughly, and didn't release it...

That pisses me off.

FAQ from the MSFT article:

What is the sp_replwritetovarbin extended stored procedure used for?
The sp_replwritetovarbin extended stored procedure is used by transactional replication with updatable subscribers and only when the subscription is created with @update_mode = 'failover' or 'queued tran'.

authors
scott whigham
grant moyle
chad weaver
recent comments
  • automobile dealers: Good post, thanks read more
  • has anyone tried proactol does work: I bought this combination for myself. I have been using read more
  • weight loss testimonials: I think this product did just want it had intended read more
  • proactol testimonials: all i have to say is wow. it worked for read more
  • The Love Calculator: I just sent this post to a bunch of my read more
  • Love Calculator: Which Golf Clubs Are Better - Steel or Graphite ? read more
  • The Love Calculator: Thanks For This Post, was added to my bookmarks. read more
  • The Love Calculator: Which Golf Clubs Are Better - Steel or Graphite ? read more
  • news trends : If you're still on the fence: grab your favorite earphones, read more
  • Diving: Which Golf Clubs Are Better - Steel or Graphite ? read more