PT-2002-2137 · Microsoft · Desktop Engine+2

Published 2002-10-11 · Updated 2018-10-12 · CVE-2002-1138

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server versions 7.0 through 2000 Microsoft Data Engine (MSDE) version 1.0 Microsoft Desktop Engine (MSDE) version 2000

Description: The issue allows attackers to overwrite system files due to the software writing output files for scheduled jobs under its own privileges instead of the entity that launched it.

Recommendations: For Microsoft SQL Server versions 7.0 through 2000, consider restricting access to scheduled jobs to minimize the risk of exploitation. For Microsoft Data Engine (MSDE) version 1.0, restrict the ability to write output files for scheduled jobs to prevent system file overwrites. For Microsoft Desktop Engine (MSDE) version 2000, limit the privileges of the entity launching scheduled jobs to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-1138

Affected Products

Data Engine

Desktop Engine

Sql Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-1138 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056 · Vendor Advisory
• http://iss.net/security_center/static/10257.php · Vendor Advisory
• http://ciac.org/ciac/bulletins/n-003.shtml · Note