CVE-2002-0649
- State
- Published
- Severity
- Not scored
- Published
- Jul 26, 2002
- Updated
- Aug 8, 2024
- Reserved
- Jun 28, 2002
Description
Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20030126 RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!mailing-list
- 20030125 Sapphire SQL Worm Analysis Completemailing-list
- oval:org.mitre.oval:def:1077vdb-entrysignature
- CA-2002-22third-party-advisory
- VU#484891third-party-advisory
- VU#399260third-party-advisory
- 20020725 Microsoft SQL Server 2000 Unauthenticated System Compromise (#NISR25072002)mailing-list
- 7945third-party-advisory
- 20030128 Re: MSDE contained in...mailing-list
- 20030125 Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!mailing-list
- 20030125 SQL Sapphire Worm Analysismailing-list
- 20030125 MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!mailing-list
- 20030125 Fw: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!mailing-list
- 20030128 RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!mailing-list
- 20030129 Re: MSDE contained in...mailing-list
- MS02-039vendor-advisory
- 20030126 Tool: Sapphire SQL Worm Scannermailing-list
- 20020725 Microsoft SQL Server 2000 Unauthenticated System Compromise (#NISR25072002)mailing-list
- 20030125 RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!mailing-list
- CA-2003-04third-party-advisory
- 5310vdb-entry
- 20030130 RE: MSDE contained in...mailing-list
- 20030201 The Spread of the Sapphire/Slammer SQL Wormmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.