Vulnerabilities > CVE-2000-1083 - Buffer Overflow vulnerability in Microsoft Data Engine and SQL Server

047910
CVSS 2.1 - LOW
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
local
low complexity
microsoft
exploit available
NVD
Published: 2001-01-09
Updated: 2018-10-12

Summary

The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.

Vulnerable Configurations

Part Description Count
Application
Microsoft
4

Exploit-Db

descriptionMicrosoft SQL Server 7.0/2000,Data Engine 1.0/2000 xp_showcolv Buffer Overflow Vulnerability. CVE-2000-1083. Local exploit for windows platform
idEDB-ID:20456
last seen2016-02-02
modified2000-12-01
published2000-12-01
reporterDavid Litchfield
sourcehttps://www.exploit-db.com/download/20456/
titleMicrosoft SQL Server 7.0/2000,Data Engine 1.0/2000 xp_showcolv Buffer Overflow Vulnerability

References