peter bassill · operator
$ cve CVE-2002-0649 JSON

CVE-2002-0649 EXPLOIT

7.5
HIGH · CVSS 2.0 · EPSS 84.8% (pctl 100)

Patch early

A public exploit exists.

Description

Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.

Scoring

CVSS7.5 (HIGH, v2.0)
VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS84.75% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-119
On CISA KEVno
Public exploityes
Published2002-08-12
Last modified2026-06-16

Affected (2)

VendorProduct
microsoftdata engine
microsoftsql server

Public exploits

SourceTitleDate
exploit-dbMicrosoft SQL Server - Resolution Overflow (MS02-039) (Metasploit)2010-04-30
exploit-dbMicrosoft SQL Server 2000 - Resolution Service Heap Overflow2002-07-25

References

→ the Explorer  ·  watch your stack  ·  NVD