Update 32bits platforms: http://www.microsoft.com/downloads/details.aspx?FamilyId=39472EE8-C14A-47B4-BFCC-87988E062D91&displaylang=en
Update 64bits 2003 srv: http://www.microsoft.com/downloads/details.aspx?FamilyId=1D93D9E4-2B22-4595-B8C5-643824857EC0&displaylang=en
Technical description:
Microsoft Data Access Components (MDAC) is a collection of components that provides the underlying functionality for a number of database operations, such as connecting to remote databases and returning data to a client. When a client system on a network tries to see a list of computers that are running SQL Server and that reside on the network, it sends a broadcast request to all the devices that are on the network. Because of a vulnerability in a specific MDAC component, an attacker could respond to this request with a specially-crafted packet that could cause a buffer overflow.
An attacker who successfully exploited this vulnerability could gain the same level of privileges over the system as the program that initiated the broadcast request. The actions an attacker could carry out would be dependent on the permissions under which the program using MDAC ran. If the program ran with limited privileges, an attacker would be limited accordingly; however, if the program ran under the local system context, the attacker would have the same level of permissions.
Since the original version of MDAC on your system may have changed from updates available on the Microsoft Web site, we recommend using the following tool to determine the version of MDAC you have on your system: Microsoft Knowledge Base article 301202 "HOW TO: Check for MDAC Version" discusses this tool and explains how to use it. Also, Microsoft Knowledge Base article 231943 discusses the release history of the different versions of MDAC.
Mitigating factors:
For an attack to be successful an attacker would have to simulate a SQL server that is on the same IP subnet as the target system.
When a client system on a network tries to see a list of computers that are running SQL Server and that reside on the network, it sends a broadcast request to all the devices that are on the network. A target system must initiate such a broadcast request to be vulnerable to an attack. An attacker would have no way of launching this first step but would have to wait for anyone to enumerate computers that are running SQL Server on the same subnet. Also, a system is not vulnerable by having these SQL management tools installed.
Code executed on the client system would only run under the privileges of the client program that made the broadcast request.
Severity Rating:
Microsoft Data Access Components 2.5 (included with Windows 2000) Important
Microsoft Data Access Components 2.6 (included with SQL Server 2000) Important
Microsoft Data Access Components 2.7 (included with Windows XP) Important
Microsoft Data Access Components 2.8 (included with Windows Server 2003) Important
The above assessment is based on the types of systems that are affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.
Vulnerability identifier: CAN-2003-0903
sa ne inlature balaurul ce ne incatuseaza de doua luni de zile!!!
Ar fi misto daca ar merge chestia asta pe un apache...pentru ca l-am pune pe server si ala e tot timpul up. In principiu gasim o solutie pt toata reteaua. Putina rabdare. 
