CVE-2002-0859

Microsoft Jet - Buffer Overflow in OpenDataSource Function

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2002-0859. PoCs published by NGSSoftware.

AI-analyzed exploit summary This exploit demonstrates a Unicode-based buffer overflow in Microsoft SQL Server's OpenDataSource function via the MS Jet Engine. It overwrites the saved return address to execute arbitrary shellcode, specifically calling CreateFile() to create a file on the target system.

Description

Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code.

Exploits (1)

exploitdb WORKING POC VERIFIED
by NGSSoftware · textdoswindows
https://www.exploit-db.com/exploits/21569

This exploit demonstrates a Unicode-based buffer overflow in Microsoft SQL Server's OpenDataSource function via the MS Jet Engine. It overwrites the saved return address to execute arbitrary shellcode, specifically calling CreateFile() to create a file on the target system.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft SQL Server 2000 SP1/SP2 with MS Jet Engine
Auth required
Prerequisites: Ability to execute T-SQL queries on the target SQL Server · MS Jet Engine component installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=102450188620081&w=2
Third Party Advisory vdb-entry x_refsource_xf
http://www.iss.net/security_center/static/9375.php
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/5057
Various Sources x_refsource_misc
http://www.nextgenss.com/advisories/mssql-ods.txt
Vendor Advisory vendor-advisory x_refsource_mskb
http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ282010

Scores

EPSS 0.2617
EPSS Percentile 97.7%

Details

Status published
Products (2)
microsoft/jet 4.0 (6 CPE variants)
microsoft/sql_server 2000 (3 CPE variants)
Published Sep 05, 2002
Tracked Since Feb 18, 2026