iDefense Security Advisory 07.08.08 – Remote exploitation of an integer underflow vulnerability within Microsoft Corp.’s SQL Server could allow a remote attacker to execute arbitrary code with the privileges of the SQL Server. The vulnerability exists within the code responsible for parsing a stored backup file. A 32-bit integer value, representing the size of a record, is taken from the file and used to calculate the number of bytes to read into a heap buffer. This calculation can underflow, which leads to insufficient memory being allocated. The buffer is subsequently overfilled leading to an exploitable condition. iDefense confirmed the existence of this vulnerability in Microsoft SQL Server 2005 Service Pack 2 Hot Fix 4. Additional tests against SQL Server 2005 without any updates suggest it is also vulnerable. Previous versions are also suspected to be vulnerable.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/68064/07.08.08-1.txt
Source: https://packetstormsecurity.com/files/68064/iDEFENSE-Security-Advisory-2008-07-08.1.html