Microsoft SQL Server and Desktop Engine contain a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to the SQL Server Resolution Service not properly sanitizing remote user input. If an attacker sends a specially crafted request (first byte set to 0x04 followed by a large string) they may be able to execute arbitrary code with the privileges of the SQL server.

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

• CVE ID: 2002-0649 (see also: NVD)
• Microsoft Knowledge Base Article: 317748
• Related OSVDB ID: 4577 878
• Metasploit ID: 4578
• CERT VU: 484891
• Bugtraq ID: 5311
• ISS X-Force ID: 9661
• CERT: CA-2002-22 CA-2003-04
• Keyword: DDOS.SQLP1434.A Sapphire Slammer SQL Slammer Worm UDP Port 1434 W32/SQLSlam-A W32/SQLSlammer
• Generic Informational URL: http://securityresponse.symantec.com/avcenter/venc/data/w32.sqlexp.worm.html
• Other Advisory URL: http://www.nextgenss.com/advisories/mssql-udp.txt
• Microsoft Security Bulletin: MS02-039

• David Litchfield - davidngssoftware.com - NGSSoftware