If you haven't already seen it, Microsoft issued an advisory regarding a remote code execution vulnerability in versions of its database server.

The problem occurs when the stored procedure "sp_replwritetovarbin" is left with execute access available to public users. The obvious fix is to deny execute access to the public. Microsoft's related advisory explains how to do that.

So if you're using SQL Server 2000, 2005, 2005 Express, 2000 Desktop Engine, or Windows Internal Database (WYukon) then you should apply the recommended workaround.