CVE-2000-1081
published 2001-01-09CVE-2000-1081: The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling…
PriorityP429medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EXPLOIT
EPSS
5.25%
91.6th percentile
The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | data_engine | — | — |
| microsoft | data_engine | — | — |
| microsoft | sql_server | — | — |
| microsoft | sql_server | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft SQL Server 7.0/2000 / Data Engine 1.0/2000 - xp_displayparamstmt Buffer Overflow
exploitdb·2000-12-01
CVE-2000-1081 Microsoft SQL Server 7.0/2000 / Data Engine 1.0/2000 - xp_displayparamstmt Buffer Overflow
Microsoft SQL Server 7.0/2000 / Data Engine 1.0/2000 - xp_displayparamstmt Buffer Overflow
---
// source: https://www.securityfocus.com/bid/2030/info
The API Srv_paraminfo(), which is implemented by Extended Stored Procedures (XPs) in Microsoft SQL Server and Data Engine, is susceptible to a buffer overflow vulnerability which may cause the application to fail or arbitrary code to be executed on the target system depending on the data entered into the buffer.
XPs are DLL files that perform high level functions in SQL Server. When called, they invoke a function called Srv_paraminfo() to parse the input parameters.
A vulnerability lies in Srv_paraminfo() and the fact that it does not check the length of the parameter string that an XP passes to it. If an attacker can pass an overly long
Exploit-DB
Microsoft IIS 4.0 - UNC Mapped Virtual Host
exploitdb·2000-03-30
CVE-2000-0246 Microsoft IIS 4.0 - UNC Mapped Virtual Host
Microsoft IIS 4.0 - UNC Mapped Virtual Host
---
MS Commercial Internet System 2.0/2.5,IIS 4.0,Proxy Server 2.0,Site Server Commerce Edition 3.0 UNC Mapped Virtual Host Vulnerability
source: https://www.securityfocus.com/bid/1081/info
If a virtual host root is mapped to a UNC share, a backward slash "\" appended to an ASP or HTR extension in a URL request to that virtual host will cause Microsoft Internet Information Server to transmit full source code of the file back to a remote user. Files located on the local drive where IIS is installed is not affected by this vulnerability.
http://target/file.asp\
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=97570878710037&w=2http://www.securityfocus.com/bid/2030https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-092https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A231http://marc.info/?l=bugtraq&m=97570878710037&w=2http://www.securityfocus.com/bid/2030https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-092https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A231
2001-01-09
Published