AppDetective™ Update 2.5.52 - 11 July 2002

NEW CHECKS

Microsoft SQL Server

Title: BULK INSERT buffer overflow

Description: Verify that a patch has been applied to fix the buffer overflow in BULK INSERT.

Summary: The built-in function BULK INSERT contains a buffer overflow that may allow an attacker to overwrite the stack and execute arbitrary code under the security context of the database. The first parameter of BULK INSERT does not properly handle a long string.

Note: Team HATTER Security Alert

Title: pwdencrypt buffer overflow

Description: Check the version to determine if the server contains a buffer overflow in the pwdencrypt function.

Summary: The built-in function pwdencrypt contains a buffer overflow that may allow an attacker to overwrite the stack and execute arbitrary code under the security context of the database. The first parameter of the function does not properly handle a long string.