Multiple Vulnerabilities In Microsoft SQL

Microsoft SQL Server 2000 and 7.0

Microsoft SQL Server 2000 Desktop Engine (MSDE 2000)

Microsoft Data Engine (MSDE) 1.0

Named Pipe Hijacking
A flaw exists in the checking method for the named pipe. The flaw can permit an attacker local to the SQL Server system to gain control of the named pipe during another client's authenticated logon. The attacker could then gain control of the named pipe at the same permission level as the user who is attempting to connect. If the user has a higher level of permissions than the attacker, the attacker will assume those rights when the named pipe is compromised.

Named Pipe Denial of Service
In the same named-pipes scenario as above, an unauthenticated user who is local to the intranet can send a large packet to a specific named pipe on which the SQL Server system is listening and cause it to become unresponsive. This scenario can create a Denial of Service (DoS) condition that would require a server restart to restore functionality.

SQL Server Buffer Overrun
A flaw in a specific Windows function might permit an authenticated user--with direct access to log on to the SQL Server system --to create a specially crafted packet that could cause a buffer overrun when sent to the system's listening local procedure call (LPC) port. This flaw can allow a user with limited system permissions to elevate his or her permissions to the level of the SQL Server service account or cause arbitrary code to run.