PT-2002-1678 · Microsoft · Sql Server Desktop Engine (Msde) 2000+1

Published 2002-07-23 · Updated 2018-10-12 · CVE-2002-0642

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2000 (affected versions not specified) Microsoft SQL Server Desktop Engine (MSDE) 2000 (affected versions not specified)

Description The issue concerns insecure permissions on a registry key in Microsoft SQL Server 2000, including MSDE 2000, which contains SQL Server service account information. This allows local users to gain privileges.

Recommendations For Microsoft SQL Server 2000, update the permissions on the registry key containing the SQL Server service account information to prevent local users from gaining privileges. For Microsoft SQL Server Desktop Engine (MSDE) 2000, update the permissions on the registry key containing the SQL Server service account information to prevent local users from gaining privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0642

Affected Products

Sql Server 2000

Sql Server Desktop Engine (Msde) 2000

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0642 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1025 · Note
• http://iss.net/security_center/static/9523.php · Note
• http://kb.cert.org/vuls/id/796313 · Note
• http://securityfocus.com/bid/5205 · Note
• http://cert.org/advisories/CA-2002-22.html · Note