PT-2002-1677 · Microsoft · Sql Server Desktop Engine (Msde) 2000+1

Publicado 2002-07-12 · Atualizado 2018-10-12 · CVE-2002-0641

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2000 Microsoft SQL Server Desktop Engine (MSDE) 2000

Description A buffer overflow issue exists in the bulk insert procedure, allowing attackers with database administration privileges to execute arbitrary code. This can be achieved by using a long filename in the BULK INSERT query.

Recommendations For Microsoft SQL Server 2000, consider restricting database administration privileges to minimize the risk of exploitation. For Microsoft SQL Server Desktop Engine (MSDE) 2000, avoid using long filenames in the BULK INSERT query until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-0641

Produtos afetados

Sql Server 2000

Sql Server Desktop Engine (Msde) 2000

Referências · 7

• http://ngssoftware.com/advisories/ms-sqlbi.txt · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-034 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A316 · Nota
• http://marc.info/?l=bugtraq&m=102639885223746&w=2 · Nota
• http://kb.cert.org/vuls/id/682620 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0641 · Nota de Segurança
• http://securityfocus.com/bid/4847 · Nota