Description

Microsoft has reported a vulnerability in MDAC (Microsoft Data Access Components), which potentially can be exploited by malicious people to compromise a vulnerable system.

The problem is that the reply, which MDAC receives when it broadcasts a request to identify all systems running SQL Server, isn't properly verified.

This allows malicious people on the network to send a specially crafted reply, which can cause a buffer overflow and possibly lead to execution of arbitrary code on a system running MDAC or SQL Server.

The vulnerability affects MDAC 2.5, 2.6, 2.7, and 2.8.

MDAC is included in Windows XP, Windows 2000, and Windows 2003 Server.

Third party applications may also install MDAC.

Solution
Microsoft has issued patches.
Further details available to Secunia VIM customers

Original Advisory
Buffer Overrun in MDAC Function Could Allow Code Execution
http://www.microsoft.com/technet/security/bulletin/MS04-003.asp

Deep Links
Links available to Secunia VIM customers