CVE-2000-1083
published 2001-01-09CVE-2000-1083: The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the…
PriorityP428low2.1CVSS 2.0
AVLACLAuNCNINAP
EXPLOIT
EPSS
5.49%
91.9th percentile
The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | data_engine | — | — |
| microsoft | data_engine | — | — |
| microsoft | sql_server | — | — |
| microsoft | sql_server | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft SQL Server 7.0/2000 / Data Engine 1.0/2000 - xp_showcolv Buffer Overflow
exploitdb·2000-12-01
CVE-2000-1083 Microsoft SQL Server 7.0/2000 / Data Engine 1.0/2000 - xp_showcolv Buffer Overflow
Microsoft SQL Server 7.0/2000 / Data Engine 1.0/2000 - xp_showcolv Buffer Overflow
---
// source: https://www.securityfocus.com/bid/2038/info
The API Srv_paraminfo(), which is implemented by Extended Stored Procedures (XPs) in Microsoft SQL Server and Data Engine, is susceptible to a buffer overflow vulnerability which may cause the application to fail or arbitrary code to be executed on the target system depending on the data entered into the buffer.
XPs are DLL files that perform high level functions in SQL Server. When called, they invoke a function called Srv_paraminfo() to parse the input parameters.
A vulnerability lies in Srv_paraminfo() and the fact that it does not check the length of the parameter string that an XP passes to it. If an attacker can pass an overly long string
Exploit-DB
Cobalt RaQ 2.0/3.0 - Apache .htaccess Disclosure
exploitdb·2000-03-31
CVE-2000-0234 Cobalt RaQ 2.0/3.0 - Apache .htaccess Disclosure
Cobalt RaQ 2.0/3.0 - Apache .htaccess Disclosure
---
source: https://www.securityfocus.com/bid/1083/info
The default configuration of Cobalt Raq2 and Raq3 servers allows remote access to .htaccess files. This could lead to unauthorized retrieval of username and password information for restricted portions of a website hosted on the server.
Make a regular GET request, specifying an .htaccess file ie:
http ://target/path/.htaccess
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=97570878710037&w=2http://www.securityfocus.com/bid/2038https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-092http://marc.info/?l=bugtraq&m=97570878710037&w=2http://www.securityfocus.com/bid/2038https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-092
2001-01-09
Published