Signature Detail
Short Name |
DB:MS-SQL:SQLMON-STACK-OFLOW |
|---|---|
Severity |
High |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
DB |
Release Date |
2004/02/19 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
DB: MS-SQL SQLMON Stack Overflow
This protocol anomaly is a stack overflow caused by sending malformed UDP packets to the SQL monitor service running on UDP/1434.
Extended Description
A vulnerability in Microsoft SQL Server 2000 could allow remote attackers to access target hosts. A problem in the SQL Server Resolution Service allows a remote attacker to execute arbitrary code on a vulnerable host. The attacker could exploit a heap-based buffer overflow in the resolution service by sending a maliciously crafted UDP packet to port 1434. ***UPDATE: A worm that may exploit this vulnerability has been detected in the wild. Administrators are advised to: - Block all external access to database servers until more information is available. - Deny access to TCP and UDP ports 1434 completely - Implement filter rules for other ports to decrease the chances of compromise through yet unknown avenues, even if the patch for this particular vulnerability has been installed. Cisco has released an advisory that details workaround information. Microsoft recommends that affected users apply SQL Server 2000 Service Pack 3.
Affected Products
- Microsoft Data Engine 2000
- Microsoft SQL Server 2000 SP1
- Microsoft SQL Server 2000 SP2
- Microsoft SQL Server 2000
- Microsoft SQL Server 2000 Desktop Engine
- Veritas Software Backup Exec for Windows Servers 9.0.0
References
- BugTraq: 5310
- CERT: CA-2003-04
- CVE: CVE-2002-0649