PT-2002-1677 · Microsoft · Sql Server Desktop Engine (Msde) 2000+1

Published 2002-07-12 · Updated 2018-10-12 · CVE-2002-0641

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2000 Microsoft SQL Server Desktop Engine (MSDE) 2000

Description A buffer overflow issue exists in the bulk insert procedure, allowing attackers with database administration privileges to execute arbitrary code. This can be achieved by using a long filename in the BULK INSERT query.

Recommendations For Microsoft SQL Server 2000, consider restricting database administration privileges to minimize the risk of exploitation. For Microsoft SQL Server Desktop Engine (MSDE) 2000, avoid using long filenames in the BULK INSERT query until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0641

Affected Products

Sql Server 2000

Sql Server Desktop Engine (Msde) 2000

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0641 · Security Note
• http://ngssoftware.com/advisories/ms-sqlbi.txt · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A316 · Note
• http://marc.info/?l=bugtraq&m=102639885223746&w=2 · Note
• http://kb.cert.org/vuls/id/682620 · Note
• http://securityfocus.com/bid/4847 · Note