HTTP: Microsoft SQL Server 2000 Client Components ActiveX Control
This signature detects attempts to exploit a known vulnerability in Microsoft SQL Server 2000 Client Components ActiveX Control (sqlvdir.dll). An attacker can create a malicious Web site containing Web pages with dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.
Extended Description
Microsoft SQL Server 'sqlvdir.dll' ActiveX Control is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions. This control is included with Microsoft SQL Server 2000; other versions may also be affected. NOTE: This BID is being retired because the issue is not exploitable. The ActiveX control is not marked 'Safe for Scripting'.
Affected Products
Microsoft sql_server_2000
Short Name
HTTP:STC:ACTIVEX:SQLVDIR-DLL
Severity
Major
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
2000 ActiveX CVE-2008-4110 Client Components Control Microsoft SQL Server bid:31129
Release Date
10/09/2008
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3724
False Positive
Unknown
Vendors
Microsoft
CVSS Score
7.6