CVE-2002-0649
published 2002-08-12CVE-2002-0649: Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a…
PriorityP269high7.5CVSS 2.0
AVNACLAuNCPIPAP
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
84.75%
99.7th percentile
Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | data_engine | — | — |
| microsoft | sql_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
0x04 (UDP packet first byte, triggers SQL Monitor thread overflow)
bytes↗
0x08 (UDP packet first byte, triggers heap corruption)
bytes
|04| ... |81 F1 03 01 04 9B 81 F1 01| ... sock ... send
bytes
|04| ... |81 F1 03 01 04 9B 81 F1| ... sock ... send
- →Detect exploit trigger: UDP packets to port 1434 where the first byte is 0x04 (stack overflow vector) or 0x08 (heap overflow vector). ↗
- →Slammer worm payload contains the byte sequence |81 F1 03 01 04 9B 81 F1 01| as well as the strings 'sock' and 'send' within the UDP payload to port 1434; match all four content patterns for high-confidence detection.
- →Monitor for outbound UDP traffic from internal hosts to external port 1434 — this indicates a Slammer-infected host attempting to propagate.
- →The exploit payload bad characters are \x00\x3a\x0a\x0d\x2f\x5c; the trigger packet starts with \x04 followed by up to ~800 bytes of text, ending with \x68:888 (push dword 0x3838383a). ↗
- →Block or alert on all UDP and TCP traffic to/from port 1434 at the network perimeter to mitigate both exploitation and worm propagation. ↗
- ·The Metasploit module targets MSSQL 2000 / MSDE pre-SP3 only; the return address 0x42b48774 is specific to that version range and will differ across service pack levels. ↗
- ·The Snort rules carry metadata confidence 'Medium' and signature_severity 'Informational', meaning they may generate noise and should be tuned before use in blocking mode.
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r8jr-r79v-cghp: Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to c
ghsa_unreviewed·2022-04-30
CVE-2002-0649 [HIGH] CWE-119 GHSA-r8jr-r79v-cghp: Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to c
Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.
VulnCheck
Microsoft data_engine Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2002·CVSS 7.5
CVE-2002-0649 [HIGH] Microsoft data_engine Improper Restriction of Operations within the Bounds of a Memory Buffer
Microsoft data_engine Improper Restriction of Operations within the Bounds of a Memory Buffer
Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.
Affected: Microsoft data_engine
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://cseweb.ucsd.edu/~savage/papers/IEEESP03.pdf
Suricata
GPL WORM Slammer Worm propagation attempt OUTBOUND
suricata·2010-09-23
CVE-2002-0649 GPL WORM Slammer Worm propagation attempt OUTBOUND
GPL WORM Slammer Worm propagation attempt OUTBOUND
Rule: alert udp $HOME_NET any -> $EXTERNAL_NET 1434 (msg:"GPL WORM Slammer Worm propagation attempt OUTBOUND"; content:"|04|"; depth:1; content:"|81 F1 03 01 04 9B 81 F1|"; content:"sock"; content:"send"; reference:bugtraq,5310; reference:bugtraq,5311; reference:cve,2002-0649; reference:nessus,11214; reference:url,vil.nai.com/vil/content/v_99992.htm; classtype:misc-attack; sid:2102004; rev:8; metadata:created_at 2010_09_23, cve CVE_2002_0649, confidence Medium, signature_severity Informational, updated_at 2019_07_26;)
Suricata
GPL SQL Slammer Worm propagation attempt
suricata·2010-09-23
CVE-2002-0649 GPL SQL Slammer Worm propagation attempt
GPL SQL Slammer Worm propagation attempt
Rule: alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"GPL SQL Slammer Worm propagation attempt"; content:"|04|"; depth:1; content:"|81 F1 03 01 04 9B 81 F1 01|"; content:"sock"; content:"send"; reference:bugtraq,5310; reference:bugtraq,5311; reference:cve,2002-0649; reference:nessus,11214; reference:url,vil.nai.com/vil/content/v_99992.htm; classtype:misc-attack; sid:2102003; rev:9; metadata:created_at 2010_09_23, cve CVE_2002_0649, confidence Medium, signature_severity Informational, updated_at 2019_07_26;)
Exploit-DB
Microsoft SQL Server - Resolution Overflow (MS02-039) (Metasploit)
exploitdb·2010-04-30
CVE-2002-0649 Microsoft SQL Server - Resolution Overflow (MS02-039) (Metasploit)
Microsoft SQL Server - Resolution Overflow (MS02-039) (Metasploit)
---
##
# $Id: ms02_039_slammer.rb 9179 2010-04-30 08:40:19Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft SQL Server Resolution Overflow',
'Description' => %q{
This is an exploit for the SQL Server 2000 resolution
service buffer overflow. This overflow is triggered by
sending a udp packet to port 1434 which starts with 0x04 and
is followed by long string terminating with a colon and a
number. This module should work against any vulnerable SQL
Server 2000
Exploit-DB
Microsoft SQL Server 2000 - Resolution Service Heap Overflow
exploitdb·2002-07-25
CVE-2002-0649 Microsoft SQL Server 2000 - Resolution Service Heap Overflow
Microsoft SQL Server 2000 - Resolution Service Heap Overflow
---
source: https://www.securityfocus.com/bid/5310/info
A vulnerability in Microsoft SQL Server 2000 could allow remote attackers to access target hosts.
A problem in the SQL Server Resolution Service allows a remote attacker to execute arbitrary code on a vulnerable host. The attacker could exploit a heap-based buffer overflow in the resolution service by sending a maliciously crafted UDP packet to port 1434.
***UPDATE:
A worm that may exploit this vulnerability has been detected in the wild.
Administrators are advised to:
- Block all external access to database servers until more information is available.
- Deny access to TCP and UDP ports 1434 completely
- Implement filter rules for other ports to decrease the chances
Metasploit
MS02-039 Microsoft SQL Server Resolution Overflow
metasploit
MS02-039 Microsoft SQL Server Resolution Overflow
MS02-039 Microsoft SQL Server Resolution Overflow
This is an exploit for the SQL Server 2000 resolution service buffer overflow. This overflow is triggered by sending a udp packet to port 1434 which starts with 0x04 and is followed by long string terminating with a colon and a number. This module should work against any vulnerable SQL Server 2000 or MSDE install (pre-SP3).
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=102760196931518&w=2http://marc.info/?l=ntbugtraq&m=102760479902411&w=2http://secunia.com/advisories/7945http://www.cert.org/advisories/CA-2002-22.htmlhttp://www.cert.org/advisories/CA-2003-04.htmlhttp://www.kb.cert.org/vuls/id/399260http://www.kb.cert.org/vuls/id/484891http://www.securityfocus.com/archive/1/308306/30/26180/threadedhttp://www.securityfocus.com/archive/1/308321/30/26180/threadedhttp://www.securityfocus.com/archive/1/308324/30/26180/threadedhttp://www.securityfocus.com/archive/1/308388/30/26180/threadedhttp://www.securityfocus.com/archive/1/308393/30/26180/threadedhttp://www.securityfocus.com/archive/1/308396/30/26150/threadedhttp://www.securityfocus.com/archive/1/308418/30/26150/threadedhttp://www.securityfocus.com/archive/1/308419/30/26150/threadedhttp://www.securityfocus.com/archive/1/308760/30/26120/threadedhttp://www.securityfocus.com/archive/1/308806/30/26120/threadedhttp://www.securityfocus.com/archive/1/309096/30/26120/threadedhttp://www.securityfocus.com/archive/1/309324/30/26120/threadedhttp://www.securityfocus.com/archive/1/309776/30/26090/threadedhttp://www.securityfocus.com/bid/5310https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-039https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1077http://marc.info/?l=bugtraq&m=102760196931518&w=2http://marc.info/?l=ntbugtraq&m=102760479902411&w=2http://secunia.com/advisories/7945http://www.cert.org/advisories/CA-2002-22.htmlhttp://www.cert.org/advisories/CA-2003-04.htmlhttp://www.kb.cert.org/vuls/id/399260http://www.kb.cert.org/vuls/id/484891http://www.securityfocus.com/archive/1/308306/30/26180/threadedhttp://www.securityfocus.com/archive/1/308321/30/26180/threadedhttp://www.securityfocus.com/archive/1/308324/30/26180/threadedhttp://www.securityfocus.com/archive/1/308388/30/26180/threadedhttp://www.securityfocus.com/archive/1/308393/30/26180/threadedhttp://www.securityfocus.com/archive/1/308396/30/26150/threadedhttp://www.securityfocus.com/archive/1/308418/30/26150/threadedhttp://www.securityfocus.com/archive/1/308419/30/26150/threadedhttp://www.securityfocus.com/archive/1/308760/30/26120/threadedhttp://www.securityfocus.com/archive/1/308806/30/26120/threadedhttp://www.securityfocus.com/archive/1/309096/30/26120/threadedhttp://www.securityfocus.com/archive/1/309324/30/26120/threadedhttp://www.securityfocus.com/archive/1/309776/30/26090/threadedhttp://www.securityfocus.com/bid/5310https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-039https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1077
2002-08-12
Published
Exploited in the wild