CVE-2002-0649

Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

84.75% chance of exploitation in the next 30 days, 100th percentile

Published

2002-07-26

Updated

2024-08-08

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/mssql/ms02_039_slammer.rb

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/21652
• https://www.exploit-db.com/exploits/16393

References

• CVE Record
• NVD entry

Related

• CVE-2002-0648
• CVE-2002-0652
• CVE-2002-0647
• CVE-2002-0653
• CVE-2002-0644
• CVE-2002-0654