Bugtraq mailing list archives

Remote DoS attack against Microsoft SQL Server 7.0


From: kbelian () BUSINESS-SOFT COM (Kevork Belian)
Date: Wed, 17 Nov 1999 16:20:45 +0200


Hi,
I'm not sure whether this has been already reported (though I couldn't find
relevant information).
MS SQL Server 7.0 silently crashes when sent a TCP packet containing more
than 2 NULLs as data.

Description:
I tested this on a machine running SQL Server version 7.00.699. The NT box
is running NT Server with SP 4 (I don't think the Service Pack is an issue
since NT is not affected).
If the TCP/IP net library is enabled, the 3 or greater NULL bytes crach SQL
Server listening on port 1433. The SQL server raises an event 17055 with
fatal exception EXCEPTION_ACCESS VIOLATION.

Can anyone reproduce this?

It's interesting to mention that:
    - 1 or 2 NULL bytes don't affect the system.
    - A nornal service restart will reboot SQL Server

rgrds
Kevork Belian


Current thread: