CVE-2002-1137 | Vulnerability Database | Aqua Security

Buffer overflow in the Database Console Command (DBCC) that handles user inputs in Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, allows attackers to execute arbitrary code via a long SourceDB argument in a non-SQL OLEDB data source such as FoxPro, a variant of CAN-2002-0644.

Affected Software

Name	Vendor	Start Version	End Version
Sql_server	Microsoft	7.0	7.0
Sql_server	Microsoft	2000	2000
Sql_server	Microsoft	7.0	7.0
Data_engine	Microsoft	1.0	1.0
Sql_server	Microsoft	2000	2000
Sql_server	Microsoft	2000	2000
Data_engine	Microsoft	2000	2000
Sql_server	Microsoft	7.0	7.0
Sql_server	Microsoft	7.0	7.0
Sql_server	Microsoft	7.0	7.0

References

http://www.securityfocus.com/bid/5877
http://www.scan-associates.net/papers/foxpro.txt
http://www.cisco.com/warp/public/707/cisco-sa-20030126-ms02-061.shtml
http://www.ciac.org/ciac/bulletins/n-003.shtml
https://exchange.xforce.ibmcloud.com/vulnerabilities/10255
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056

NVD	https://nvd.nist.gov/vuln/detail/CVE-2002-1137
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html