CVE

Id
2649  
CVE No.
CVE-2000-1081  
Status
Candidate  
Description
The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.  
Phase
Modified (20061101)  
Votes
ACCEPT(3) Baker, Cole, Magdych | MODIFY(1) Frech | NOOP(1) Christey | REVIEWING(1) Wall  
Comments
Baker> ALready posted in refs | Christey> ADDREF XF:mssql-xp-paraminfo-bo | URL:http://xforce.iss.net/static/5622.php | Frech> XF:mssql-xp-paraminfo-bo(5622)  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
10381 2649 CVE-2000-1081 ATSTAKE:20001201 Microsoft SQL Server extended stored procedure vulnerability  View
10382 2649 CVE-2000-1081 URL:http://marc.info/?l=bugtraq&m=97570878710037&w=2  View
10383 2649 CVE-2000-1081 MS:MS00-092  View
10384 2649 CVE-2000-1081 URL:http://www.microsoft.com/technet/security/bulletin/ms00-092.asp  View
10385 2649 CVE-2000-1081 BID:2030  View
10386 2649 CVE-2000-1081 URL:http://www.securityfocus.com/bid/2030  View
10387 2649 CVE-2000-1081 OVAL:oval:org.mitre.oval:def:231  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
64312 JVNDB-2000-000092 Microsoft SQL Server の xp_displayparamstmt() 関数におけるバッファオーバーフローの脆弱性 ------------ CVE-2000-1081 2649 4.6 http://jvndb.jvn.jp/ja/contents/2000/JVNDB-2000-000092.html  View