PT-2002-2142 · Microsoft · Desktop Engine+2

Publicado 2002-10-21 · Atualizado 2018-10-12 · CVE-2002-1145

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server versions 7.0 through 2000 Microsoft Data Engine (MSDE) version 1.0 Microsoft Desktop Engine (MSDE) 2000

Description: The issue concerns the xp runwebtask stored procedure in the Web Tasks component, which can be executed by PUBLIC. This allows an attacker to gain privileges by updating a webtask owned by the database owner through the msdb.dbo.mswebtasks table, due to weak permissions.

Recommendations: For Microsoft SQL Server versions 7.0 through 2000, restrict access to the xp runwebtask stored procedure to prevent unauthorized execution. For Microsoft Data Engine (MSDE) version 1.0, limit access to the msdb.dbo.mswebtasks table to minimize the risk of exploitation. For Microsoft Desktop Engine (MSDE) 2000, consider revoking PUBLIC execute permissions on the xp runwebtask stored procedure as a temporary workaround.

Correção

Identificadores relacionados

CVE-2002-1145

Produtos afetados

Data Engine

Desktop Engine

Sql Server

Referências · 8

• http://securityfocus.com/bid/5980 · Nota
• http://iss.net/security_center/static/10388.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-1145 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=103487044122900&w=2 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-061 · Aviso do Fabricante
• http://cisco.com/warp/public/707/cisco-sa-20030126-ms02-061.shtml · Aviso do Fabricante
• http://marc.info/?l=ntbugtraq&m=103486356413404&w=2 · Nota
• http://nextgenss.com/advisories/mssql-webtasks.txt · Nota