CVE

Id
2652  
CVE No.
CVE-2000-1084  
Status
Candidate  
Description
The xp_updatecolvbm function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.  
Phase
Proposed (20001219)  
Votes
ACCEPT(3) Baker, Cole, Magdych | MODIFY(1) Frech | NOOP(1) Christey | REVIEWING(1) Wall  
Comments
Christey> ADDREF XF:mssql-xp-paraminfo-bo | URL:http://xforce.iss.net/static/5622.php | Frech> XF:mssql-xp-paraminfo-bo(5622)  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
10398 2652 CVE-2000-1084 ATSTAKE:20001201 Microsoft SQL Server extended stored procedure vulnerability  View
10399 2652 CVE-2000-1084 URL:http://marc.info/?l=bugtraq&m=97570878710037&w=2  View
10400 2652 CVE-2000-1084 MS:MS00-092  View
10401 2652 CVE-2000-1084 URL:http://www.microsoft.com/technet/security/bulletin/ms00-092.asp  View
10402 2652 CVE-2000-1084 BID:2039  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
64315 JVNDB-2000-000095 Microsoft SQL Server の xp_updatecolvbm() 関数におけるバッファオーバーフローの脆弱性 ------------ CVE-2000-1084 2652 4.6 http://jvndb.jvn.jp/ja/contents/2000/JVNDB-2000-000095.html  View