Microsoft SQL Server 2000 Resolution Service Heap Overflow Vulnerability

Bugtraq ID:	5310
Class:	Boundary Condition Error
CVE:	CVE-2002-0649 CVE-2002-0729
Remote:	Yes
Local:	No
Published:	Jul 25 2002 12:00AM
Updated:	Nov 15 2007 12:40AM
Credit:	Vulnerability discovery credited to David Litchfield.
Vulnerable:	Veritas Software Backup Exec for Windows Servers 9.0 Microsoft SQL Server 2000 Desktop Engine + Akiva WebBoard 6.1 + Microsoft Access 2000 + Microsoft Application Center 2000 + Microsoft BizTalk Server 2000 Developer Edition + Microsoft BizTalk Server 2000 Enterprise Edition + Microsoft BizTalk Server 2000 Standard Edition + Microsoft BizTalk Server 2002 Developer Edition + Microsoft BizTalk Server 2002 Enterprise Edition + Microsoft Office 2000 + Microsoft Project Central Server + Microsoft SharePoint Team Services from Microsoft + Microsoft Visio 2000 Enterprise Edition + Microsoft Visio Enterprise Network Tools + Microsoft Visual FoxPro 6.0 + Microsoft Visual Studio 6.0 + Microsoft Visual Studio .NET Academic Edition 0 + Microsoft Visual Studio .NET Enterprise Architect Edition + Microsoft Visual Studio .NET Enterprise Developer Edition + Microsoft Visual Studio .NET Professional Edition + SmartMax Software MailMax 5.0 + Veritas Software Backup Exec for Windows Servers 9.0 Microsoft SQL Server 2000 SP2 Microsoft SQL Server 2000 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 Microsoft SQL Server 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 Microsoft Data Engine 2000 + Akiva WebBoard 6.1 + BindView bv-Admin for Microsoft Exchange + BindView bv-Admin for Windows 7.0 + BindView bv-Admin for Windows Migration + BindView bv-control for Active Directory 7.0.2 + BindView bv-Control for Internet Security 7.0.1 + BindView bv-Control for Microsoft Exchange 7.0 + BindView bv-Control for Microsoft SQL Server 7.0.1 + BindView bv-Control for Microsoft SQL Server 7.0 + BindView bv-Control for Windows 7.0.2 + CARI-RUSCO Secure Perfect 3.0 + CCH Equity Compliance Insider Reporting Module + Collins Medical Plus 2000 + Computer Associates Unicenter + Computer Associates Unicenter RC/Update 6.1 + Computer Associates Unicenter RC/Update 6.0 + CSIRO BioLink Software 1.5 + DATA.TXT Corporation Time Matters 4.0 + DATA.TXT Corporation Time Matters 3.0 + Dell OpenManage IT Assistant 6.0 + Dell OpenManage IT Assistant 5.0 + Express Metrix Express Software Manager 6.0.2 + Express Metrix Express Software Manager 6.0.1 + Express Metrix Express Software Manager 6.0 + Express Metrix Express Software Manager 5.0 + Fluke Networks Optiview Network Inspector 5.0 + HP Openview Internet Services 4.5 + HP Openview Internet Services 4.0 + HP Openview Operations for Windows 7.1 + HP Openview Operations for Windows 7.0 + HP Openview Operations for Windows 6.0 + HP Openview Reporter 3.0 + HP Openview Reporter 2.0.2 + ISI Infortel for Windows 5.4 + ISI Infortel for Windows 5.2 + ISI Infortel for Windows 5.1 + ISI Infortel for Windows 4.0 + Journyx Timesheet 5.0 + Journyx Timesheet 4.6 + Journyx Timesheet 4.5 m3 + Journyx Timesheet 4.5 m2 + Journyx Timesheet 4.5 + Journyx Timesheet 2.0 + Microsoft .NET Framework 1.1 + Microsoft .NET Framework 1.0 SP1 + Microsoft .NET Framework 1.0 + Microsoft .NET Framework SDK 1.0 + Microsoft Application Center 2000 + Microsoft Biztalk Server 2002 Partner Edition 0 + Microsoft FrontPage 2000 Server Extensions SR 1.3 + Microsoft FrontPage 2000 Server Extensions SR 1.2 + Microsoft FrontPage 2000 Server Extensions SR 1.1 + Microsoft FrontPage 2000 Server Extensions SR 1.0 + Microsoft Great Plains 5.5.1 + Microsoft Great Plains 7.0 + Microsoft Great Plains 5.5 + Microsoft Great Plains 5.0 + Microsoft Office 2000 SP2 + Microsoft Office 2000 SP1 + Microsoft Office 2000 + Microsoft Office 2000 Chinese Version + Microsoft Office 2000 Japanese Version + Microsoft Office 2000 Korean Version + Microsoft Office XP SP1 + Microsoft Office XP + Microsoft Office XP Developer Edition + Microsoft Project Central Server + Microsoft SharePoint Portal Server 2001 SP1 + Microsoft SharePoint Portal Server 2001 + Microsoft SharePoint Team Services from Microsoft + Microsoft SQL Server 2000 SP3 + Microsoft SQL Server 2000 SP2 + Microsoft SQL Server 2000 SP1 + Microsoft SQL Server 2000 + Microsoft Visio 2000 Enterprise Edition + Microsoft Visio Enterprise Network Tools + Microsoft Visual FoxPro 7.0 SP1 + Microsoft Visual FoxPro 7.0 + Microsoft Visual FoxPro 6.0 + Microsoft Visual Studio .NET Academic Edition 0 + Microsoft Visual Studio .NET Enterprise Architect Edition + Microsoft Visual Studio .NET Enterprise Developer Edition + Microsoft Visual Studio .NET Professional Edition + Microsoft Visual Studio .NET Trial Edition 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows XP Embedded SP1 + Microsoft Windows XP Embedded + MIP NonProfit Series Pro 4.5 + MIP NonProfit Series Pro 4.4 + MIP NonProfit Series Pro 4.3 + NetSupport NetSupport TCO 4.5.1 + NetSupport NetSupport TCO 4.5 + Network Associates SupportMagic SQL 4.5 + Okena StormWatch + Peachtree Software Timeslips 11.0 + Peachtree Software Timeslips 10.0 + Peachtree Software Timeslips 9.0 + Peachtree Software Timeslips 9.0 + Peachtree Software Timeslips 8.0 + Peachtree Software Timeslips 7.0 + Peachtree Software Timeslips 6.0 + QiNetix CommVault Galaxy 4.0.1 + SalesLogix Corporation SalesLogix 2000.0 + SmartMax Software MailMax 5.0 + TeleStream FlipFactory 3.0 + TeleStream FlipFactory 2.0 + TeleStream FlipFactory 1.2 + Veritas Software Backup Exec for Windows Servers 9.0 + VIGILANTe SecureScan NX 2.5 + Visionary Systems Firehouse Software 5.4 + Visionary Systems Firehouse Software 5.0.2 5 + Visionary Systems Firehouse Software 5.0 + Visionary Systems Firehouse Software 3.0.5 + Wonderware InTouch 7.11 + Xerox CentreWare Web 1.0

Not Vulnerable:	Microsoft SQL Server 2000 SP3