Netwiz Pty Ltd Information for VU#484891

Microsoft SQL Server 2000 contains stack buffer overflow in SQL Server Resolution Service

Status

Not Affected

Vendor Statement

MonTel is a Telephone call accounting system with a server and clients for use
on a computer network. A default installation of MonTel is not vulnerable to
the 'Slammer' worm since it only installs MSDE 1.0. (MonTel is also provided
with the MS Jet engine for use on small work groups, though this is being
phased out in favour of MSDE.)
MonTel can, however, also be used on a pre-existing MS SQL Server 2000, which
is vulnerable. SQL 2000 should be fully secured and the latest patches applied.
Details of this can be found at:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bul
letin/MS02-039.asp
.

For MSDE 1.0 we recommend that MonTel sites apply the Service Pack 4 patch for
Microsoft SQL 7.0 which is used to also patch MSDE 1.0 and the SQL Server 7.0
Security Update for Service Pack 4. More detail on where to find these, and
other information can be found on the Netwiz web site at
http://www.netwiz.com.au/appnotes/i3154.htm.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

None

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.