Secunia

Microsoft has issued a patch for MDAC due to a vulnerability which allows malicious people to cause a buffer overflow.

The problem is that the reply which MDAC receives when it broadcasts a request to identify all systems running SQL Server isn't properly verified. This allows malicious people on the network to send a specially crafted reply which could cause a buffer overflow and possibly lead to execution of arbitrary code on a system running MDAC or SQL Server.

MDAC 2.5, 2.6 and 2.7 is affected.

MDAC is included in Windows XP, Windows 2000 and Windows ME.

Third party applications may also install MDAC.

Solution
The patch is available from:
Further details available in Customer Area

Provided and/or discovered by
Aaron C. Newman, Application Security

Original Advisory
http://www.microsoft.com/technet/security/bulletin/MS03-033.asp

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area