PT-2002-1684 · Microsoft · Sql Server 2000+1

Published 2002-07-26 · Updated 2018-10-19 · CVE-2002-0649

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2000 Microsoft Desktop Engine 2000 (MSDE)

Description The issue is related to multiple buffer overflows in the Resolution Service, which can be exploited by sending specific UDP packets to port 1434. This can cause a denial of service or allow remote attackers to execute arbitrary code. The exploitation can occur through two methods: (1) a 0x04 byte that generates a long registry key name, or (2) a 0x08 byte with a long string that causes heap corruption. This issue has been exploited by the Slammer/Sapphire worm.

Recommendations For Microsoft SQL Server 2000, apply the available patch to fix the buffer overflow issues. For Microsoft Desktop Engine 2000 (MSDE), apply the available patch to fix the buffer overflow issues. As a temporary workaround, consider restricting access to UDP port 1434 to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2002-0649

Affected Products

2000 Desktop Engine

Sql Server 2000

References · 27

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/mssql/ms02_039_slammer.rb · Exploit
• 🔥 https://exploit-db.com/exploits/21652 · Exploit
• 🔥 https://exploit-db.com/exploits/16393 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0649 · Security Note
• http://secunia.com/advisories/7945 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-039 · Vendor Advisory
• http://securityfocus.com/archive/1/309324/30/26120/threaded · Note
• http://securityfocus.com/archive/1/308396/30/26150/threaded · Note
• http://cert.org/advisories/CA-2003-04.html · Note
• http://cert.org/advisories/CA-2002-22.html · Note
• http://securityfocus.com/archive/1/308760/30/26120/threaded · Note
• http://marc.info/?l=bugtraq&m=102760196931518&w=2 · Note
• http://securityfocus.com/archive/1/308393/30/26180/threaded · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1077 · Note
• http://securityfocus.com/archive/1/309776/30/26090/threaded · Note