CVE-2000-1088: Medium severity Microsoft SQL Server vulnerability

Published Dec 19, 2000

Updated

The xpSetSQLSecurity function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srvparaminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.

Affected Software

4 affected components

Microsoft SQL Server=7.0

Microsoft Data Engine=1.0

Microsoft SQL Server=2000

Microsoft Data Engine=2000

Remediation

Patch Available

http://www.securityfocus.com/bid/2043

Event History

Dec 19, 2000

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-1088?

CVE-2000-1088 is considered a high severity vulnerability due to its ability to cause denial of service.

How do I fix CVE-2000-1088?

To mitigate CVE-2000-1088, apply the latest security updates provided by Microsoft for SQL Server 2000 and MSDE.

What systems are affected by CVE-2000-1088?

CVE-2000-1088 affects Microsoft SQL Server 2000, SQL Server 7.0, and Microsoft Data Engine (version 1.0 and 2000).

What kind of attack can exploit CVE-2000-1088?

CVE-2000-1088 can be exploited by attackers to trigger a denial of service through improper handling of buffer lengths.

Is CVE-2000-1088 still a risk today?

While CVE-2000-1088 is an older vulnerability, it remains a risk for organizations running unpatched versions of the affected software.