PT-2002-1685 · Microsoft · Sql Server 2000

Publicado 2002-08-12 · Atualizado 2018-10-12 · CVE-2002-0650

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2000

Description The issue allows remote attackers to cause a denial of service, specifically bandwidth consumption, by sending a "ping" style packet to the Resolution Service on UDP port 1434 with a spoofed IP address of another SQL Server system. This action causes the two servers to exchange packets in an infinite loop.

Recommendations For Microsoft SQL Server 2000, consider restricting access to the Resolution Service on UDP port 1434 to prevent spoofed packets from initiating the denial of service. As a temporary workaround, consider implementing firewall rules to block unsolicited UDP traffic on port 1434.

Correção

Identificadores relacionados

CVE-2002-0650

Produtos afetados

Sql Server 2000

Referências · 7

• http://osvdb.org/878 · Nota
• http://marc.info/?l=bugtraq&m=102760196931518&w=2 · Nota
• http://marc.info/?l=ntbugtraq&m=102760479902411&w=2 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-039 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0650 · Nota de Segurança
• http://iss.net/security_center/static/9662.php · Nota
• http://securityfocus.com/bid/5312 · Nota