PT-2002-1678 · Microsoft · Sql Server Desktop Engine (Msde) 2000+1

Publicado 2002-07-23 · Atualizado 2018-10-12 · CVE-2002-0642

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2000 (affected versions not specified) Microsoft SQL Server Desktop Engine (MSDE) 2000 (affected versions not specified)

Description The issue concerns insecure permissions on a registry key in Microsoft SQL Server 2000, including MSDE 2000, which contains SQL Server service account information. This allows local users to gain privileges.

Recommendations For Microsoft SQL Server 2000, update the permissions on the registry key containing the SQL Server service account information to prevent local users from gaining privileges. For Microsoft SQL Server Desktop Engine (MSDE) 2000, update the permissions on the registry key containing the SQL Server service account information to prevent local users from gaining privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-0642

Produtos afetados

Sql Server 2000

Sql Server Desktop Engine (Msde) 2000

Referências · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-034 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1025 · Nota
• http://iss.net/security_center/static/9523.php · Nota
• http://kb.cert.org/vuls/id/796313 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0642 · Nota de Segurança
• http://securityfocus.com/bid/5205 · Nota
• http://cert.org/advisories/CA-2002-22.html · Nota