Microsoft has warned of a vulnerability in SQL Server 2000 and 2005 (various editions). Read more about it here.

There is a work-around provided in the Microsoft article to seal off the vulnerability.