Multiple Vulnerabilities in Microsoft SQL Server 2000 - 26 Jul 2002

Reported July 24, 2002, by Microsoft.



  • Microsoft SQL Server 2000

  • Microsoft Desktop Engine (MSDE) 2000




Microsoft has reported three new vulnerabilities in Microsoft SQL Server 2000 and Microsoft SQL Server Desktop Engine (MSDE). The vulnerabilities are:

  • Two buffer overrun vulnerabilities on the SQL Server Resolution Service running on port 1434. By sending a carefully crafted packet to the Resolution Service, an attacker could cause portions of system memory (the heap in one case, the stack in the other) to be overwritten, resulting in a buffer overrun.

  • A Denial of Service (DoS) vulnerability to the same service. This vulnerability involves sending spoofed source keep-alive packets to port 1434 from one SQL server to another, which could result in a never-ending keep-alive packet exchange from one server to the other and greatly diminished performance.



The vendor, Microsoft, has released Security Bulletin MS02-039 (Buffer Overruns in SQL Server 2000 Resolution Service Could Enable Code Execution) to address this vulnerability and recommends that affected users download and apply the appropriate patch mentioned in the security bulletin.


Discovered by David Litchfield of Next Generation Security Software.

TAGS: Security
Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.