CVE-2002-0649
Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.
- Affected products
- 2000 Desktop Engine, Sql Server 2000
- Microsoft Data Engine
- = 2000
- Microsoft Sql Server
- = 2000
- Fix
- Available
- CVSS 2.0
- 7.5 HIGH
- EPSS
- 84.8% (100th percentile)
- Weakness
- CWE-119
- NVD status
- Modified
- Published
- 2002-07-26
CVE-2002-0649 at NVD
8 known exploits for CVE-2002-0649
Proof-of-concept code and exploit modules indexed by Sploitus
Microsoft SQL Server - Resolution Overflow (MS02-039) (Metasploit)
Microsoft SQL Server Resolution Overflow
Microsoft SQL Server 2000 resolution service buffer overflow
Microsoft SQL Server 2000 resolution service buffer overflow
Microsoft SQL Server 2000 resolution service buffer overflow
Microsoft SQL Server 2000 resolution service buffer overflow
MS02-039 Microsoft SQL Server Resolution Overflow
Microsoft SQL Server 2000 - Resolution Service Heap Overflow