CVE-2002-1123
published 2002-09-24CVE-2002-1123: Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute…
PriorityP259high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
77.71%
99.5th percentile
Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the "Hello" overflow.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | data_engine | — | — |
| microsoft | sql_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x12\x01\x00\x34\x00\x00\x00\x00\x00\x00\x15\x00\x06\x01\x00\x1b\x00\x01\x02\x00\x1c\x00\x0c\x03\x00\x28\x00\x04\xff\x08\x00\x02\x10\x00\x00\x00
bytes↗
\x00\x24\x01\x00\x00
bytes↗
\x1B\xA5\xEE\x34
- →Detect exploit attempts by matching the malformed MSSQL 'Hello' packet header bytes (0x12 0x01 0x00 0x34 ...) followed by an oversized payload (>=528 bytes of filler) and the tail bytes (0x00 0x24 0x01 0x00 0x00) on TCP/1433. ↗
- →Alert on TCP/1433 connections where the initial client packet begins with the 36-byte MSSQL pre-auth 'Hello' header (starting \x12\x01\x00\x34) and the total packet length significantly exceeds 36 bytes, indicating a buffer overflow attempt before authentication. ↗
- →If the SQL Server process stops responding (no reply) after receiving a large packet on TCP/1433, this is a strong indicator of successful exploitation or crash — the PoC checks for absence of response as the vulnerability indicator. ↗
- →The Metasploit module targets MSSQL 2000 / MSDE installations prior to SP3; use mssql_ping or banner-grabbing on TCP/1433 to identify unpatched instances as high-priority targets. ↗
- ·The exploit payload space is limited to 512 bytes and null bytes (\x00) are bad characters; shellcode used in detection rules or emulation must respect these constraints. ↗
- ·The Metasploit module uses two hardcoded return addresses (0x42b68aba and 0x42d01e50) specific to MSSQL 2000 / MSDE targets; detection signatures relying on these exact values may miss variants using different return addresses. ↗
- ·Additional MSSQL instances may be discoverable on non-standard ports via the UDP/1434 resolver service; scanning only TCP/1433 may miss all exposed instances. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft SQL Server - Hello Overflow (MS02-056) (Metasploit)
exploitdb·2010-04-30
CVE-2002-1123 Microsoft SQL Server - Hello Overflow (MS02-056) (Metasploit)
Microsoft SQL Server - Hello Overflow (MS02-056) (Metasploit)
---
##
# $Id: ms02_056_hello.rb 9179 2010-04-30 08:40:19Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft SQL Server Hello Overflow',
'Description' => %q{
By sending malformed data to TCP port 1433, an
unauthenticated remote attacker could overflow a buffer and
possibly execute code on the server with SYSTEM level
privileges. This module should work against any vulnerable
SQL Server 2000 or MSDE install ( [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$Revisi
Exploit-DB
Microsoft SQL Server 2000 - User Authentication Remote Buffer Overflow
exploitdb·2002-08-06·CVSS 2.1
CVE-2002-1123 [LOW] Microsoft SQL Server 2000 - User Authentication Remote Buffer Overflow
Microsoft SQL Server 2000 - User Authentication Remote Buffer Overflow
---
source: https://www.securityfocus.com/bid/5411/info
A vulnerability has been discovered in Microsoft SQL Server that could make it possible for remote attackers to gain access to target hosts.
It is possible for an attacker to cause a buffer overflow condition on the vulnerable SQL server with a malformed login request. This may allow a remote attacker to execute arbitrary code as the SQL Server process.
This vulnerability reportedly occurs even before authentication can proceed.
##
#
# this script tests for the "You had me at hello" overflow
# in MSSQL (tcp/1433)
# Copyright Dave Aitel (2002)
# Bug found by: Dave Aitel (2002)
#
##
#TODO:
#techically we should also go to the UDP 1434 resolver service
#and get
Metasploit
MS02-056 Microsoft SQL Server Hello Overflow
metasploit
MS02-056 Microsoft SQL Server Hello Overflow
MS02-056 Microsoft SQL Server Hello Overflow
By sending malformed data to TCP port 1433, an unauthenticated remote attacker could overflow a buffer and possibly execute code on the server with SYSTEM level privileges. This module should work against any vulnerable SQL Server 2000 or MSDE install (< SP3).
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=102873609025020&w=2http://online.securityfocus.com/archive/1/286220http://www.ciac.org/ciac/bulletins/n-003.shtmlhttp://www.iss.net/security_center/static/9788.phphttp://www.securityfocus.com/bid/5411https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056http://marc.info/?l=bugtraq&m=102873609025020&w=2http://online.securityfocus.com/archive/1/286220http://www.ciac.org/ciac/bulletins/n-003.shtmlhttp://www.iss.net/security_center/static/9788.phphttp://www.securityfocus.com/bid/5411https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056
2002-09-24
Published