7.5
CVSSv2

CVE-2002-1123

Published: 24/09/2002 Updated: 12/10/2018
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 800
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote malicious users to execute arbitrary code via a long request to TCP port 1433, aka the "Hello" overflow.

Affected Products

Vendor Product Versions
MicrosoftData Engine2000
MicrosoftSql Server2000

Exploits

source: wwwsecurityfocuscom/bid/5411/info A vulnerability has been discovered in Microsoft SQL Server that could make it possible for remote attackers to gain access to target hosts It is possible for an attacker to cause a buffer overflow condition on the vulnerable SQL server with a malformed login request This may allow a remote att ...
## # $Id: ms02_056_hellorb 9179 2010-04-30 08:40:19Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' class M ...

Metasploit Modules

MS02-056 Microsoft SQL Server Hello Overflow

By sending malformed data to TCP port 1433, an unauthenticated remote attacker could overflow a buffer and possibly execute code on the server with SYSTEM level privileges. This module should work against any vulnerable SQL Server 2000 or MSDE install (< SP3).

msf > use exploit/windows/mssql/ms02_056_hello
      msf exploit(ms02_056_hello) > show targets
            ...targets...
      msf exploit(ms02_056_hello) > set TARGET <target-id>
      msf exploit(ms02_056_hello) > show options
            ...show and set options...
      msf exploit(ms02_056_hello) > exploit