{"schemaVersion":3,"id":"CVE-2008-5416","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka \"SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability.\"","dates":{"published":"2008-12-10T13:33:00.000Z","modified":"2024-08-07T10:56:45.789Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9,"severity":"high","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.87036,"percentile":0.9975,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.87036},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.87036,"percentile":0.9975}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.87036,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.87036,"percentile":0.9975}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_598F437B66ACBE31","name":"Exploit Reference (sec-consult.com)","source":"reference","url":"http://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_2D19390B8CD838AD","name":"Exploit Reference (securityfocus.com)","source":"reference","url":"http://www.securityfocus.com/bid/32710","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"7501","name":"Microsoft SQL Server - 'sp_replwritetovarbin()' Heap Overflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/7501","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"local","platform":"windows","file":"exploits/windows/local/7501.asp","codes":["OSVDB-50589","CVE-2008-5416","CVE-2008-4270"]},"metasploit":null},{"id":"16392","name":"Microsoft SQL Server - sp_replwritetovarbin Memory Corruption (MS09-004) (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/16392","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/16392.rb","codes":["CVE-2008-5416","OSVDB-50589","MS09-004"]},"metasploit":null},{"id":"16396","name":"Microsoft SQL Server - sp_replwritetovarbin Memory Corruption (MS09-004) (via SQL Injection) (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/16396","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/16396.rb","codes":["CVE-2008-5416","OSVDB-50589","MS09-004"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_MSSQL_MS09_004_SP_REPLWRITETOVARBIN","name":"MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/mssql/ms09_004_sp_replwritetovarbin.rb","maturity":"weaponized","reliabilityScore":0.6666666666666666,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/mssql/ms09_004_sp_replwritetovarbin","rank":"400","rankName":"good","postAuth":false,"check":true,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}},{"id":"MSF_EXPLOIT_WINDOWS_MSSQL_MS09_004_SP_REPLWRITETOVARBIN_SQLI","name":"MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/mssql/ms09_004_sp_replwritetovarbin_sqli.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/mssql/ms09_004_sp_replwritetovarbin_sqli","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":7,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"microsoft","product":"sql_server","name":"SQL Server","label":"sql_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2000","noFixRecorded":false,"fixedIn":null},{"text":"2005","noFixRecorded":false,"fixedIn":null}],"versionsText":"2000 | 2005","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"mssqlserver","label":"Microsoft SQL Server","category":"database"}},"hubHref":"/vendor/microsoft/sql_server"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt","label":"www.sec-consult.com/files/20081209_mssql-2000-sp_replwritetovarbin_memwrite.txt","hostname":"www.sec-consult.com","tags":["X Refsource MISC","Exploit"]},{"url":"http://www.vupen.com/english/advisories/2008/3380","label":"www.vupen.com/english/advisories/2008/3380","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://secunia.com/advisories/33034","label":"secunia.com/advisories/33034","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://osvdb.org/50917","label":"osvdb.org/50917","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://securitytracker.com/id?1021363","label":"securitytracker.com/id?1021363","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"https://www.exploit-db.com/exploits/7501","label":"www.exploit-db.com/exploits/7501","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB"]},{"url":"http://securitytracker.com/id?1021490","label":"securitytracker.com/id?1021490","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/47182","label":"exchange.xforce.ibmcloud.com/vulnerabilities/47182","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://www.kb.cert.org/vuls/id/696644","label":"www.kb.cert.org/vuls/id/696644","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://www.securityfocus.com/archive/1/499042/100/0/threaded","label":"www.securityfocus.com/archive/1/499042/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.securityfocus.com/archive/1/499085/100/0/threaded","label":"www.securityfocus.com/archive/1/499085/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS"]},{"url":"http://securityreason.com/securityalert/4706","label":"securityreason.com/securityalert/4706","hostname":"securityreason.com","tags":["Third Party Advisory","X Refsource SREASON"]},{"url":"http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html","label":"www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html","hostname":"www.vmware.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.microsoft.com/technet/security/advisory/961040.mspx","label":"www.microsoft.com/technet/security/advisory/961040.mspx","hostname":"www.microsoft.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.securityfocus.com/bid/32710","label":"www.securityfocus.com/bid/32710","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Exploit"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6217","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6217","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2011-0003.html","label":"www.vmware.com/security/advisories/VMSA-2011-0003.html","hostname":"www.vmware.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-041A.html","label":"www.us-cert.gov/cas/techalerts/TA09-041A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.html","label":"archives.neohapsis.com/archives/fulldisclosure/2008-12/0304.html","hostname":"archives.neohapsis.com","tags":["Mailing List","X Refsource FULLDISC"]},{"url":"http://www.securityfocus.com/archive/1/516397/100/0/threaded","label":"www.securityfocus.com/archive/1/516397/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2009-055.htm","label":"support.avaya.com/elmodocs2/security/ASA-2009-055.htm","hostname":"support.avaya.com","tags":["X Refsource CONFIRM"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":["CVE-2008-4270"],"related":[]},"timeline":[{"kind":"published","date":"2008-12-10T13:33:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T10:56:45.789Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T21:40:14.542Z","stale":false,"partial":false}}