The Database Hacker's Handbook: Defending Database Servers

Exploiting Design Flaws

In Chapter 21, the section SQL Server Processes and Ports described the usage of SQLPing to determine information about the database using a single-byte UDP query packet sent to the SQL Monitor service on port 1434. But what if the value of this packet is set to a value other than the expected 0x02? If the values 0x00 through 0xFF are sent to an unpatched server, the SQL Server will cease responding to any requests after 0x08 is sent. Clearly, the unexpected input has not been handled gracefully and further investigation is needed. The interesting values prove to be 0x04, which permits a stack-based buffer overflow; 0x08, which causes a heap overflow; and 0x0A, which can produce a network denial of service.

The SQL Slammer Overflow

The overflow that occurs using a leading byte of 0x04 was exploited by the SQL Slammer worm, which caused widespread Internet disruption and financial losses in January 2003. When SQL Server receives a UDP packet on its monitor port with the leading byte set to 0x04, the SQL Monitor thread uses the remainder of the packet to form a registry key to open. This operation, however, is performed using an unsafe string copy. The following example sends a packet made up of a leading 0x04 followed by the hexadecimal ASCII codes for the string REGKEY.

Incoming packet:

\x04\x52\x45\x47\x4B\x45\x59

Registry key SQL Server will attempt to open

HKLM\Software\Microsoft\Microsoft SQL Server
\REGKEY\MSSQLServer\CurrentVersion

If the string ...