I know there are still some SQL Server 2000 installs that exist out there. With Microsoft no longer supporting these versions, how can I check to see what vulnerabilities remain unpatched?
This website lists some of the vulnerabilities but I am unable to determine which have fixes/patches to address the vulnerabilities. http://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-251/version_id-3147/Microsoft-Sql-Server-2000.html
If there are faults found since it dropped out of the extended support period then unless you have paid Microsoft for extended extended support you can be pretty sure there is not a fix available to you.
Obviously you can mitigate the risk considerably by following standard practise and making sure the only machines that can touch your SQL instance are a select few application servers within your firewall(s) and making sure all of them are fully patched up & so forth.
