Technical Information

Brief overview of the risk:
A remote code execution vulnerability exists in the way that SQL Server checks parameters in the “sp_replwritetovarbin” extended stored procedure.
Detailed Information on the risk:
The vulnerability could allow remote code execution if untrusted users have access to an affected system or if a SQL injection vulnerability exists on an affected system. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts. Further information on this exploit is available at : MS09-004