Visio Enterprise Network Tools installed with MSDE 2000 may make your computer vulnerable to the Slammer worm (814052)


The information in this article applies to:

  • Microsoft Visio 2002 Professional
  • Microsoft Visio Enterprise Network Tools
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SUMMARY

Microsoft Visio Enterprise Network Tools (VENT) includes an AutoDiscovery and Layout solution. To install this functionality, you must first install the SQL Server Desktop Engine (also known as MSDE 2000) included on the VENT CD-ROM. After you install MSDE 2000, your computer may be vulnerable to the Slammer worm. For more information about the Slammer worm, visit the following Microsoft Web site:

http://www.microsoft.com/security/slammer.asp

NOTE: MSDE 2000 is not installed in any default installation configuration of VENT. To install MSDE 2000, you must run a separate installation process.

This article describes how VENT users who manually installed MSDE 2000 can help protect their computers from the Slammer worm .

MORE INFORMATION

To help protect your computer from the Slammer worm, use one of the following methods.

Method 1: Run the SQL Critical Update Wizard to Update the Affected Files

For additional information about the SQL Critical Update Wizard, click the following article number to view the article in the Microsoft Knowledge Base:

814372 Overview of the SQL 2000 Critical Update Wizard

Method 2: Install SQL Server 2000 SP3

Identify the Windows Installer file (.msi) that was used to install MSDE 2000, download and install the SQL Server 2000 Service Pack 3, and then make sure that your System Administrator (SA) account has a strong password. The following steps explain this process in detail.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
  1. Right-click the MSSQL icon on your Microsoft Windows taskbar, and then click Exit to stop the MSDE service.
  2. Identify the .msi file that was used to install your instance of MSDE 2000.

    To do this, follow the steps according to your instance of MSDE 2000.

    Default instance
    1. Click Start, and then click Run.
    2. In the Open box, type Regedit, and then click OK.
    3. Locate and then select the following registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Setup

    4. In the right pane of the Registry Editor window, double-click ProductCode. In the Value data box, note the string value.
    5. Click OK, and then close Registry Editor.

    Named instance
    1. Click Start, and then click Run.
    2. In the Open box, type Regedit, and then click OK.
    3. Locate and then select the following registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\

    4. In the Microsoft SQL Server key, locate and select the registry key that represents the first named instance of MSDE 2000.

      NOTE: It is possible to install multiple named instances of MSDE 2000. Each named instance will have a unique registry key located in the Microsoft SQL Server key.
    5. Locate and then select the Setup key.
    6. In the right pane of the Registry Editor window, double-click ProductCode. In the Value data box, note the string value.
    7. If multiple named instance of MSDE 2000 exist, repeat steps b through e until you have identified the ProductCode string value of each named instance.
    8. Click OK, and then close Registry Editor.
  3. Click the following Microsoft Knowledge Base article, and then use the table in the article to identify the original patch package name that corresponds with the ProductCode or ProductCodes strings that were identified in the pervious steps. (For example, "SqlRun01.msi"):

    311762 INF: How to Identify Which MSI File Was Used for an Existing MSDE Installation

  4. (Optional) Identify the language that was used to install the instance of MSDE 2000 on your computer. To do this, use the following steps according to your instance of MSDE 2000.

    NOTE: This step is only necessary if you are not sure which language was used to install MSDE 2000. If you are confident that you know what language was used to install MSDE 2000, skip this step.

    Default instance
    1. Click Start, and then click Run.
    2. In the Open box, type Regedit, and then click OK.
    3. Locate and then select the following registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\CurrentVersion\

    4. In the right pane of the Registry Editor window, double-click Language. In the Edit DWORD Value dialog box, click Decimal, and then in the Value data box, note the DWORD value.
    5. Click OK, and then close Registry Editor.

    Named instance
    1. Click Start, and then click Run.
    2. In the Open box, type Regedit, and then click OK.
    3. Locate and then select the following registry key

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\

      instance_name\MSSQLServer\CurrentVersion

      where instance_name is a named instance of MSDE 2000.
    4. In the right hand of the Registry Editor window, double-click Language. In the Edit DWORD Value dialog box, click Decimal, and then in the Value data box, note the DWORD value.
    5. Click OK.
    6. If multiple named instance of MSDE 2000 exist, repeat steps b through d until you have identified the Language DWORD value of each named instance.
    7. Close Registry Editor.

    Use the Language DWORD value to identify the language that was used to install MSDE 2000 on your computer. To do this, use the following table:

    Language DWORD ValueLanguage
    1028Traditional Chinese
    1031German
    1033English
    1034Spanish
    1036 French
    1040 Italian
    1041 Japanese
    1042 Korean
    1043 Dutch
    1046 Brazilian
    1053 Swedish
    2052 Simplified Chinese
  5. Download SQL Server 2000 Service Pack 3.

    To do this:
    1. Visit the following Microsoft Web site:

      http://www.microsoft.com/sql/downloads/2000/sp3.asp

    2. Select the language that matches your version of MSDE 2000 from the Full Download box on the right side of your screen, and then click Go.
    3. Locate the download link to the SQL2KDeskSP3.exe file, and then click the download link to start the download.

      NOTE: Non-English versions of the download will be listed as language_SQL2KDeskSP3.exe.

      Where language represents the language version of the download.
    4. When prompted, save the file to your Windows Desktop.
  6. Install SQL Server 2000 Service Pack 3.

    To do this:
    1. In Windows Explorer, double-click the SQL Server 2000 Service Pack 3 download that you previously saved to your desktop.
    2. Click I Agree, to accept the License Agreement.
    3. In the Installation Folder box, type C:\sql2ksp3, and then click Continue.
    4. Click Start, click Run, and then type the following command in the Open box

      C:\sql2ksp3\msde\setup.exe /upgradesp C:\sql2ksp3\msde\setup\SqlRunXX.msi BLANKSAPWD=1

      where SqlRunXX.msi is the .msi file identified in step 2. (e.g. SqlRun01.msi)
    5. Click OK.

      NOTE: When installing SQL Server 2000 Service Pack 3, if you do not enter the correct original package name, you will receive the following error message:
      The instance name specified is invalid
  7. Restart your computer, and then log on as the Administrator to the local computer.
  8. When your computer restarts, make sure that the MSDE 2000 service is currently running on your computer.

    To do this:
    1. Click Start, click Run, type sqlmangr.exe in the Open box, and then click OK.
    2. In the Server box , select the MSDE instance that you just patched.
    3. In the Services box, click SQL Server.
    4. Click Start/Continue.
  9. Run the sp_password stored procedure to set the SA password.

    To do this:
    1. Click Start, click Run, type cmd in the Open box, and then click OK.
    2. At the command prompt, type the appropriate command according to your instance of MSDE 2000, and then press ENTER.

      Default instance type:

      osql -E

      NOTE: This command connects you to the local, default instance of MSDE 2000 by using the SA account.

      Named instance type:

      Osql -S server_name\instance_name -E

      where server_name is the name of the server and instance_name is the instance name of MSDE 2000.
    3. Type the following commands (including single quotes) on separate lines, pressing ENTER after each line.

      sp_password NULL, 'strong_password', 'sa'
      go
      quit

      where strong_password is your new SA password.
    4. Close the Command console.

REFERENCES

For additional information about how to install SQL Server 2000 SP3, see the SP3ReadMe.htm file. To access this file, download SQL Server 2000 SP3, double-click the download, allow Setup to copy the update files to your local disk, locate the following folder and double-click the SP3ReadMe.htm file.

C:\sql2ksp3\msde\



For additional information on how to manage the SQL Server Desktop Engine (MSDE 2000), click the following article number to view the article in the Microsoft Knowledge Base:

325003 How To Manage the SQL Server Desktop Engine (MSDE 2000) by Using the Osql Utility

Modification Type:MinorLast Reviewed:7/27/2006
Keywords:kbsetup kbhowto kbinfo KB814052
©2004 Microsoft Corporation. All rights reserved.