PT-2002-1685 · Microsoft · Sql Server 2000

Published 2002-08-12 · Updated 2018-10-12 · CVE-2002-0650

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2000

Description The issue allows remote attackers to cause a denial of service, specifically bandwidth consumption, by sending a "ping" style packet to the Resolution Service on UDP port 1434 with a spoofed IP address of another SQL Server system. This action causes the two servers to exchange packets in an infinite loop.

Recommendations For Microsoft SQL Server 2000, consider restricting access to the Resolution Service on UDP port 1434 to prevent spoofed packets from initiating the denial of service. As a temporary workaround, consider implementing firewall rules to block unsolicited UDP traffic on port 1434.

Fix

Related Identifiers

CVE-2002-0650

Affected Products

Sql Server 2000

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0650 · Security Note
• http://osvdb.org/878 · Note
• http://marc.info/?l=bugtraq&m=102760196931518&w=2 · Note
• http://marc.info/?l=ntbugtraq&m=102760479902411&w=2 · Note
• http://iss.net/security_center/static/9662.php · Note
• http://securityfocus.com/bid/5312 · Note