CVE-2002-1123: Microsoft SQL Server 2000 authentication buffer overflow (Hello overflow)

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityPre-authentication remote code execution on a network-exposed database service with a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

The authentication function in Microsoft SQL Server 2000 and MSDE 2000 contains a buffer overflow reachable through a long request sent to TCP port 1433, known as the "Hello" overflow. A remote, unauthenticated attacker can trigger it before authentication completes, making it a pre-auth code execution flaw in a widely deployed database service.

Impact

An attacker can execute arbitrary code with the privileges of the SQL Server service, potentially leading to full host compromise and data theft or destruction.

Attack surface

Reachable over the network via TCP port 1433 with no authentication required, since the flaw is in the authentication handshake itself. No user interaction is needed; the vector is AV:N/AC:L/Au:N.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.777, 99.5th percentile), indicating strong likelihood of exploitation activity. Reference tags include only a Vendor Advisory, with no public exploit tag supplied.

What to do

• Apply the Microsoft security bulletin MS02-056 update for SQL Server 2000 and MSDE 2000.
• Block or restrict TCP port 1433 from untrusted networks with host and perimeter firewalls.
• Disable or remove MSDE 2000 instances that are not required, and avoid exposing database services directly to the internet.
• Run the SQL Server service under a low-privilege account to limit the impact of successful code execution.
• Monitor vendor advisories for any updated guidance, since the record is old and product version detail is absent.

Detection

• Inspect network traffic to TCP port 1433 for oversized or malformed authentication/Hello requests.
• Alert on unexpected SQL Server service crashes or restarts, which can indicate failed exploitation attempts.
• Monitor for suspicious child processes or command execution spawned by the SQL Server service account.
• Review firewall and IDS logs for scanning or connection attempts against port 1433 from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.