DB: MS-SQL Server HELLO Overflow

This signature detects attempts to exploit a known vulnerability against a Microsoft SQL Server Daemon. Attackers can send a malicious hello packet to a Microsoft SQL Server daemon that can cause a remote SYSTEM/LOCAL level compromise and thereby gain control of the target system.

Extended Description

A vulnerability has been discovered in Microsoft SQL Server that could make it possible for remote attackers to gain access to target hosts. It is possible for an attacker to cause a buffer overflow condition on the vulnerable SQL server with a malformed login request. This may allow a remote attacker to execute arbitrary code as the SQL Server process. This vulnerability reportedly occurs even before authentication can proceed.

Affected Products

Microsoft data_engine_2000

References

BugTraq: 5411

CVE: CVE-2002-1123

Short Name

DB:MS-SQL:HELLO-OF

Severity

Major

Recommended

False

Recommended Action

Drop

DB: MS-SQL Server HELLO Overflow

Extended Description

Affected Products

References

Found a potential security threat?