PT-2002-2137 · Microsoft · Desktop Engine+2

Publicado 2002-10-11 · Atualizado 2018-10-12 · CVE-2002-1138

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server versions 7.0 through 2000 Microsoft Data Engine (MSDE) version 1.0 Microsoft Desktop Engine (MSDE) version 2000

Description: The issue allows attackers to overwrite system files due to the software writing output files for scheduled jobs under its own privileges instead of the entity that launched it.

Recommendations: For Microsoft SQL Server versions 7.0 through 2000, consider restricting access to scheduled jobs to minimize the risk of exploitation. For Microsoft Data Engine (MSDE) version 1.0, restrict the ability to write output files for scheduled jobs to prevent system file overwrites. For Microsoft Desktop Engine (MSDE) version 2000, limit the privileges of the entity launching scheduled jobs to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-1138

Produtos afetados

Data Engine

Desktop Engine

Sql Server

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-1138 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056 · Aviso do Fabricante
• http://ciac.org/ciac/bulletins/n-003.shtml · Nota
• http://iss.net/security_center/static/10257.php · Aviso do Fabricante