CVE-2001-0542

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2002-02-18 · updated 2026-06-16

Description

Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror, (2) formatmessage, or (3) xp_sprintf. NOTE: the C runtime format string vulnerability reported in MS01-060 is identified by CVE-2001-0879.

Affected products

Microsoft SQL Server: 7.0, 2000

References

http://marc.info/?l=bugtraq&m=100891252317406&w=2
http://www.atstake.com/research/advisories/2001/a122001-1.txt
http://www.kb.cert.org/vuls/id/700575
http://www.securityfocus.com/bid/3733
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-060
https://exchange.xforce.ibmcloud.com/vulnerabilities/7724
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A83
http://marc.info/?l=bugtraq&m=100891252317406&w=2
http://www.atstake.com/research/advisories/2001/a122001-1.txt
http://www.kb.cert.org/vuls/id/700575
http://www.securityfocus.com/bid/3733
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-060

Get alerted when CVE-2001-0542 or the next vulnerability affects your stack