PT-2002-2702 · Microsoft · Sql Server

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-1981

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server versions 2000 through 2000 SP2

Description The issue allows the "public" role to execute certain stored procedures, which enables attackers to modify configuration settings. This includes SQL server startup and alert settings through the execution of the (1) sp MSSetServerProperties or (2) sp MSsetalertinfo stored procedures.

Recommendations For Microsoft SQL Server versions 2000 through 2000 SP2, restrict access to the sp MSSetServerProperties and sp MSsetalertinfo stored procedures to prevent unauthorized configuration changes.

Correção

Identificadores relacionados

CVE-2002-1981

Produtos afetados

Sql Server

Referências · 5

• http://securityfocus.com/bid/5604 · Nota
• http://iss.net/security_center/static/10012.php · Nota
• http://seclists.org/lists/bugtraq/2002/Sep/0009.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-1981 · Nota de Segurança
• http://ngssoftware.com/advisories/mssql-sp_MSSetServerProperties.txt · Aviso do Fabricante