Select the product you need help with

FIX: SQL Server Text Formatting Functions Contain Unchecked Buffers

Article ID: 304850 - View products that this article applies to.

This article was previously published under Q304850

BUG #: 354983 (SHILOH_BUGS)

SYMPTOMS

SQL Server 2000 provides a number of functions that enable database queries to generate text messages. In some cases, the functions create a text message and store it in a variable; in others, the functions directly display the message. Microsoft has discovered a vulnerability with these functions.

Use of an invalid format type character may allow SQL Server to overwrite an internal buffer that may overwrite an address in the SQL Server process space with arbitrary data. If SQL Server overwrites an address in the SQL Server process space with arbitrary data, SQL Server may potentially allow you to execute arbitrary code within SQL Server or the SQL Server process may abnormally terminate.
For additional information about this security fix, visit the following Microsoft Web site:

Microsoft Security Bulletin MS01-060

(http://www.microsoft.com/technet/security/bulletin/MS01-060.mspx)

To ensure that you are running the latest security updates for SQL Server 2000, see the following article in the Microsoft Knowledge Base:

316426

(http://support.microsoft.com/kb/316426/EN-US/ )

SQL Server 2000 Security Update for Service Pack 1

Back to the top | Give Feedback

CAUSE

The SQL Server parser incorrectly allows you to use an invalid type character with some text functions.

Back to the top | Give Feedback

RESOLUTION

To resolve this problem, obtain Microsoft SQL Server 2000 Service Pack 2.

For information on how to obtain SQL Server 2000 Service Pack 2 (SP2), see the following article in the Microsoft Knowledge Base:

290211

(http://support.microsoft.com/kb/290211/EN-US/ )

INF: How to Obtain the Latest SQL Server 2000 Service Pack

If you are not able to upgrade to Microsoft SQL Server 2000 Service Pack 2, you have to refer to the following Microsoft Knowledge Base article to obtain all of the security updates for SQL Server 2000 Service Pack 1:

316426

(http://support.microsoft.com/kb/316426/EN-US/ )

SQL Server 2000 Security Update for Service Pack 1

Back to the top | Give Feedback