CVE-2000-1087

Medium

Description

The xp_proxiedmetadata function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.

SeverityMedium

CVSS4.6

Exploit probability—

Product

Microsoft Data Engine

PublishedJan 9, 2001

First seenJan 9, 2001

How to fix

Vendor advisories

docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-092

Affected products

Product	Affected versions	Fixed in
microsoft data_engine	1.0, 2000	—
microsoft sql_server	7.0, 2000	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.