Rule:--Sid:2050--Summary:of MS-SQL server running on a host.--Impact:Denial of Service, possible code execution and control of the server.--Detailed Information:Versions of Microsofts implementation of SQL server running the resolution service are subject to multiple buffer overflows.It is possible to overwrite memory with data of the attackers choosing, resulting in a denial of service or possible code execution. This is done by sending carefully crafted packets to the resolution service running on the server.It is also possible for the attacker to cause a denial of service by sending a spoofed packet purporting to be from one SQL server to another. The resulting exchange between the two servers could result in a denial of service.--Affected Systems:	Cisco BBSM 5.0	Cisco BBSM 5.1	Cisco CallManager 3.3.x	Cisco Unity 3.x	Cisco Unity 4.x		Microsoft .NET Framework 1.0	Microsoft SQL Server 2000	Windows 2000 Any version	Windows NT Any version--Attack Scenarios:The SQL Slammer (Sapphire) worm exploited the vulnerabilities in this service.--Ease of Attack:Simple--False Positives:This rule can be triggered by UDP responses to requests originating fromephemeral port 1434. Example: a DNS response with transaction ID between0x0400 and 0x04FF.--False Negatives:None Known--Corrective Action:Update all instances of the vulnerable systems with patches from the vendor.Use a firewall to deny access to ports used by the SQL server, usually 1433 and 1434, from the Internet.--Contributors:Sourcefire Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:Microsoft:http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms02-039.aspCVE:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0649Bugtraq:http://www.securityfocus.com/bid/5310http://www.securityfocus.com/bid/5311--