PT-2002-1684 · Microsoft · Sql Server 2000+1

Publicado

2002-07-26

·

Atualizado

2018-10-19

·

CVE-2002-0649

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2000 Microsoft Desktop Engine 2000 (MSDE)
Description The issue is related to multiple buffer overflows in the Resolution Service, which can be exploited by sending specific UDP packets to port 1434. This can cause a denial of service or allow remote attackers to execute arbitrary code. The exploitation can occur through two methods: (1) a 0x04 byte that generates a long registry key name, or (2) a 0x08 byte with a long string that causes heap corruption. This issue has been exploited by the Slammer/Sapphire worm.
Recommendations For Microsoft SQL Server 2000, apply the available patch to fix the buffer overflow issues. For Microsoft Desktop Engine 2000 (MSDE), apply the available patch to fix the buffer overflow issues. As a temporary workaround, consider restricting access to UDP port 1434 to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2002-0649

Produtos afetados

2000 Desktop Engine
Sql Server 2000