CVE-2000-1083

Low

Description

The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.

SeverityLow

CVSS2.1

Exploit probability—

Product

Microsoft Data Engine

PublishedJan 9, 2001

First seenJan 9, 2001

How to fix

Vendor advisories

docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-092

Affected products

Product	Affected versions	Fixed in
microsoft data_engine	1.0, 2000	—
microsoft sql_server	7.0, 2000	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.