Microsoft SQL Server 2000 pwdencrypt() Buffer Overflow
15 Jun. 2002
Summary
Microsoft SQL Server 2000's pwdencrypt() stored procedure has been found to contain an exploitable buffer overflow, the overflow is caused by providing large buffer to the function.
Vulnerable systems:
* Microsoft SQL Server 2000 (up to SP2)
Microsoft SQL Server's contains two undocumented password encryption functions, pwdencrypt and pwdcompare, one of these functions, pwdencrypt has been found to contain a remotely exploitable buffer overflow.
Example: SELECT pwdencrypt(REPLICATE('A',353))
Vendor status:
The vulnerability was confirmed by Microsoft but has not yet provided information on when a patch will be released.
