sp_replwritetovarbin memory overwrite Security threat

The only issue you may run into is that, if you are using replication with
updatable subscriptions, you will break the replication by DENYing execute on
it.

Try this to fix it:
USE master
GO


SET NOCOUNT ON;

DECLARE
@fixit BIT,
@DBName varchar(255),
@sql varchar(2000)

SET @fixit = 1

-- LIMIT THE CHECK TO DATABASE THAT ARE MARKED WITH A REPLICATION STATUS
DECLARE DBCursor CURSOR FOR
SELECT [name] FROM master..sysdatabases WHERE [category] <> 0

OPEN DBCursor
FETCH NEXT FROM DBCursor INTO @DBName

WHILE @@FETCH_STATUS = 0
BEGIN
-- CHECK THE DATABASE FOR THE EXISTENCE OF MSsubscription_agents.
-- IF THERE, QUERY THE TABLE FOR AN [update_mode] IN (4,5) -
participating in updateable subscription

-- IF PARTICIPATING, SET @fixit TO '0'
-- BUILD THE SQL STRING
SELECT @sql =
'USE ' + QUOTENAME(@DBName, '[') + ';
IF OBJECT_ID('''+ 'MSsubscription_agents' + ''') IS NOT NULL
BEGIN
IF EXISTS(SELECT [update_mode] FROM
[MSsubscription_agents] WHERE [update_mode] IN (4,5))

BEGIN
SELECT @fixit = 0
END
END'

-- EXECUTE THE STRING RETURNING @fixit

EXEC sp_executesql @sql, N'@fixit BIT OUT', @fixit OUT
FETCH NEXT FROM DBCursor INTO @DBName
END
-- CLEAN UP
CLOSE DBCursor
DEALLOCATE DBCursor

-- If the @Fixit was not set to 0, Deny the permission

IF @fixit = 1
BEGIN
PRINT 'Fix Applied'
DENY EXECUTE ON sp_replwritetovarbin TO PUBLIC
END ELSE
BEGIN
PRINT 'Updatable Subscription Found. Fix Not Applied'
END

"jaylou" wrote:

> this is true.
>
> In my spare time, I am researching what this proc is for and what needs
> acces to it.
>
> I will remove the access on a dev server and see what happens.
>
> Thanks Again,
> Joe
>
>
>
>
> "Chris Wood" wrote:
>
> > Joe,
> >
> > If you are talking SQL2005 you cannot delete it but you can take away the
> > public access to it. I would do the same on SQL2000, just stop it being
> > accessed by the public role.
> >
> > Chris
> >
> > "jaylou" wrote in message
> >
> > >I agree. I am waiting until I hear from Microsoft. I think the alert came
> > > from a third party consulting group. looking for work maybe?
> > >
> > > "lmpreiki" wrote:
> > >
> > >> Even though I've searched the Microsoft website and anywhere else I can
> > >> think
> > >> of several times I haven't found anything either. I can't possibly
> > >> delete a
> > >> procedure on without knowing what impact it might have.
> > >>
> > >> "jaylou" wrote:
> > >>
> > >> > Not yet, and I still havent seen any alerts from Microsoft on this.
> > >> >
> > >> >
> > >> > "lmpreiki" wrote:
> > >> >
> > >> > > Was anyone able to identify what this proc does or what might break
> > >> > > if removed?
> > >> > >
> > >> > > Thanks,
> > >> > >
> > >> > > "jaylou" wrote:
> > >> > >
> > >> > > > I recieved an email about this procedure sp_replwritetovarbin. one
> > >> > > > recomendation is to remove it from your system.
> > >> > > >
> > >> > > > Does anyone know what this proc is for and what will break if
> > >> > > > removed?
> > >> > > >
> > >> > > > Also does anyone know if this is a real threat?
> > >> > > >
> > >> > > > TIA,
> > >> > > > Joe
> >
> >
> >

This is primarily related to replication. If you remove it, you can break
any replication you may be running. You should DENY Execute to this stored
proc UNLESS you are running replication with Updatable Subscriptions.

Try this:
USE master
GO

SET NOCOUNT ON;

DECLARE
@fixit BIT,
@DBName varchar(255),
@sql varchar(2000)

SET @fixit = 1

-- LIMIT THE CHECK TO DATABASE THAT ARE MARKED WITH A REPLICATION STATUS
DECLARE DBCursor CURSOR FOR
SELECT [name] FROM master..sysdatabases WHERE [category] <> 0

OPEN DBCursor
FETCH NEXT FROM DBCursor INTO @DBName

WHILE @@FETCH_STATUS = 0
BEGIN
-- CHECK THE DATABASE FOR THE EXISTENCE OF MSsubscription_agents.
-- IF THERE, See if it's in an updatable subscription, If not set the
variable

SELECT @sql =
'USE ' + QUOTENAME(@DBName, '[') + ';
IF OBJECT_ID('''+ 'MSsubscription_agents' + ''') IS NOT NULL
BEGIN
IF EXISTS(SELECT [update_mode] FROM
[MSsubscription_agents] WHERE [update_mode] IN (4,5))
BEGIN
SELECT @fixit = 0
END
END'

-- EXECUTE THE STRING RETURNING @fixit
EXEC sp_executesql @sql, N'@fixit BIT OUT', @fixit OUT

FETCH NEXT FROM DBCursor INTO @DBName
END
-- CLEAN UP
CLOSE DBCursor
DEALLOCATE DBCursor

-- If the variable was not set to 0, apply the fix
IF @fixit = 1
BEGIN
PRINT 'No Updatable Subscriptions -- Applying Fix'
DENY EXECUTE ON sp_replwritetovarbin TO PUBLIC
END ELSE
BEGIN
PRINT 'Updatable Subscription - Fix not applied.'
END


"jaylou" wrote:

> I recieved an email about this procedure sp_replwritetovarbin. one
> recomendation is to remove it from your system.
>
> Does anyone know what this proc is for and what will break if removed?
>
> Also does anyone know if this is a real threat?
>
> TIA,
> Joe