3. VU#225555 - Microsoft SQL Server contains buffer overflow in
   pwdencrypt() function (CAN-2002-0624)

     The Microsoft SQL Server provides multiple methods for users to
     authenticate to SQL databases. When SQL Server Authentication is
     used, the username and password of each database user is stored in a
     database on the SQL server. When users supply a password to the
     server using this method, a function named pwdencrypt() is
     responsible for encrypting the user-supplied password so that it can
     be compared to the encrypted password stored on the SQL server.

     There is a buffer overflow in pwdencrypt() that allows remote
     attackers to execute arbitrary code on the SQL server by supplying a
     crafted password value.  Successful exploitation of this
     vulnerability requires knowledge of a valid username and will cause
     the supplied code to execute with the privileges of the SQL service
     account.
http://www.securityfocus.com/advisories/4308
http://www.securityfocus.com/bid/5311/discussion/

4. VU#399260 - Microsoft SQL Server 2000 contains heap buffer overflow in
   SQL Server Resolution Service (CAN-2002-0649)

     The SQL Server Resolution Service (SSRS) was introduced in Microsoft
     SQL Server 2000 to provide referral services for multiple server
     instances running on the same machine. The service listens for
     requests on UDP port 1434 and returns the IP address and port number
     of the SQL server instance that provides access to the requested
     database.

     The SSRS contains a heap buffer overflow that allows unauthenticated
     remote attackers to execute arbitrary code by sending a crafted
     request to port 1434/udp. The code within such a request will be
     executed by the server host with the privileges of the SQL Server
     service account.
http://www.securityfocus.com/advisories/4308
http://www.securityfocus.com/bid/5311/discussion/

5. VU#484891 - Microsoft SQL Server 2000 contains stack buffer overflow in
   SQL Server Resolution Service (CAN-2002-0649)

     The SSRS also contains a stack buffer overflow that allows
     unauthenticated remote attackers to execute arbitrary code by sending
     a crafted request to port 1434/udp. The code within such a request
     will be executed by the server host with the privileges of the SQL
     Server service account.
http://www.securityfocus.com/advisories/4308
http://www.securityfocus.com/bid/5311/discussion/

6. Microsoft SQL Server uses LPC (Local Procedure Calls) to
implement some of its inter-processes communication. The
port providing this service can be used by anyone. By sending
a specially crafted message to SQL Server through this port,
an attacker can overwrite certain parts of memory and thus
execute code using the SQL Server's credentials.
http://www.securityfocus.com/archive/1/330179

The port providing this service can be used by anyone.

НЕЗАЧЕТ

7. Microsoft SQL Server supports SQL queries over a named pipe. This
pipe allows write access to the group "Everyone" and is therefor
accessible to anyone that can authenticate, local or remote. By
sending a large request to this pipe (size depends on service pack
level), the service can be rendered unresponsive. The behavior of
the service depends upon the service pack level.
http://www.securityfocus.com/archive/1/330177

therefor
accessible to anyone that can authenticate, local or remote.

8. MS SQL Server has two means of authenticating users. One uses Windows
Authentication, and the other is the built-in SQL Authentication (which
includes the 'sa' account). The passwords for the SQL Authentication are
sent over the network using a very weak password encryption method. This was
first mentioned in David Litchfield's paper "Threat Profiling Microsoft SQL
Server".
http://www.securityfocus.com/archive/1/298361