CVE

Id
2650  
CVE No.
CVE-2000-1082  
Status
Candidate  
Description
The xp_enumresultset function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.  
Phase
Proposed (20001219)  
Votes
ACCEPT(3) Baker, Cole, Magdych | MODIFY(1) Frech | NOOP(1) Christey | REVIEWING(1) Wall  
Comments
Christey> ADDREF XF:mssql-xp-paraminfo-bo | URL:http://xforce.iss.net/static/5622.php | Frech> XF:mssql-xp-paraminfo-bo(5622)  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
10388 2650 CVE-2000-1082 ATSTAKE:20001201 Microsoft SQL Server extended stored procedure vulnerability  View
10389 2650 CVE-2000-1082 URL:http://marc.info/?l=bugtraq&m=97570878710037&w=2  View
10390 2650 CVE-2000-1082 MS:MS00-092  View
10391 2650 CVE-2000-1082 URL:http://www.microsoft.com/technet/security/bulletin/ms00-092.asp  View
10392 2650 CVE-2000-1082 BID:2031  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
64313 JVNDB-2000-000093 Microsoft SQL Server の xp_enumresultset() 関数におけるバッファオーバーフローの脆弱性 ------------ CVE-2000-1082 2650 4.6 http://jvndb.jvn.jp/ja/contents/2000/JVNDB-2000-000093.html  View