PT-2003-1669 · Microsoft · Sql Server

Publicado 2003-07-10 · Atualizado 2019-04-30 · CVE-2003-0496

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server versions prior to Windows 2000 SP4

Description: The issue allows local users to gain privileges as the SQL Server user. This is achieved by calling the xp fileexist extended stored procedure with a named pipe as an argument instead of a normal file.

Recommendations: For Microsoft SQL Server versions prior to Windows 2000 SP4, consider restricting access to the xp fileexist extended stored procedure to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2003-0496

Produtos afetados

Sql Server

Referências · 7

• 🔥 https://exploit-db.com/exploits/22883 · Exploit
• 🔥 http://atstake.com/research/advisories/2003/a070803-1.txt · Exploit
• 🔥 https://exploit-db.com/exploits/22882 · Exploit
• http://marc.info/?l=bugtraq&m=105830986720243&w=2 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0013.html · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=105820282607865&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0496 · Nota de Segurança