Microsoft SQL Server 2000 Password Encrypt Procedure Buffer Overflow Vulnerability

BID:5014

Info

Microsoft SQL Server 2000 Password Encrypt Procedure Buffer Overflow Vulnerability

Bugtraq ID: 5014
Class: Boundary Condition Error
CVE: CVE-2002-0624
Remote: No
Local: Yes
Published: Jun 14 2002 12:00AM
Updated: Jul 11 2009 01:56PM
Credit: This issue was reported by martin rakhmanoff <[email protected]>.
Vulnerable: Microsoft SQL Server 2000 Desktop Engine
+ Akiva WebBoard 6.1
+ Microsoft Access 2000
+ Microsoft Application Center 2000
+ Microsoft BizTalk Server 2000 Developer Edition
+ Microsoft BizTalk Server 2000 Enterprise Edition
+ Microsoft BizTalk Server 2000 Standard Edition
+ Microsoft BizTalk Server 2002 Developer Edition
+ Microsoft BizTalk Server 2002 Enterprise Edition
+ Microsoft Office 2000
+ Microsoft Project Central Server
+ Microsoft SharePoint Team Services from Microsoft
+ Microsoft Visio 2000 Enterprise Edition
+ Microsoft Visio Enterprise Network Tools
+ Microsoft Visual FoxPro 6.0
 + Microsoft Visual Studio 6.0
 + Microsoft Visual Studio .NET Academic Edition 0
 + Microsoft Visual Studio .NET Enterprise Architect Edition
+ Microsoft Visual Studio .NET Enterprise Developer Edition
+ Microsoft Visual Studio .NET Professional Edition
+ SmartMax Software MailMax 5.0
+ Veritas Software Backup Exec for Windows Servers 9.0
Microsoft SQL Server 2000 SP2
Microsoft SQL Server 2000 SP1
- Microsoft Windows 2000 Professional SP2
 - Microsoft Windows 2000 Professional SP1
 - Microsoft Windows 2000 Professional
- Microsoft Windows NT 4.0 SP6a
 - Microsoft Windows NT 4.0 SP6
 - Microsoft Windows NT 4.0 SP5
 Microsoft SQL Server 2000
- Microsoft Windows 2000 Professional SP2
 - Microsoft Windows 2000 Professional SP1
 - Microsoft Windows 2000 Professional
- Microsoft Windows NT 4.0 SP6a
 - Microsoft Windows NT 4.0 SP6
 - Microsoft Windows NT 4.0 SP5
 - Microsoft Windows NT 4.0
Not Vulnerable: Microsoft SQL Server 2000 SP3

Discussion

Microsoft SQL Server 2000 Password Encrypt Procedure Buffer Overflow Vulnerability

A buffer overflow vulnerability has been reported in SQL Server 2000. The vunerability is a result of an unchecked buffer when using the password encrypt procedure. This procedure is used by administrators to provides support for the storage of SQL Server Authentication credentials.

The overrun condition is due to an unbounded data copy operation that occurs when processing the procedure arguments. Attackers may exploit this vulnerability by invoking the password encrypt procedure with excessive input.

This issue may be related to the vulnerabilities reported in Bugtraq ID 4847.

Exploit / POC

Microsoft SQL Server 2000 Password Encrypt Procedure Buffer Overflow Vulnerability

The following proof-of-concept was submitted:

SELECT pwdencrypt(REPLICATE('A',353))

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] &lt;mailto:[email protected]&gt;.

Solution / Fix

Microsoft SQL Server 2000 Password Encrypt Procedure Buffer Overflow Vulnerability

Solution:
Fixes available:


Microsoft SQL Server 2000

Microsoft SQL Server 2000 SP1

Microsoft SQL Server 2000 Desktop Engine

Microsoft SQL Server 2000 SP2

References

Microsoft SQL Server 2000 Password Encrypt Procedure Buffer Overflow Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report