PT-2002-2142 · Microsoft · Desktop Engine+2

Published 2002-10-21 · Updated 2018-10-12 · CVE-2002-1145

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server versions 7.0 through 2000 Microsoft Data Engine (MSDE) version 1.0 Microsoft Desktop Engine (MSDE) 2000

Description: The issue concerns the xp runwebtask stored procedure in the Web Tasks component, which can be executed by PUBLIC. This allows an attacker to gain privileges by updating a webtask owned by the database owner through the msdb.dbo.mswebtasks table, due to weak permissions.

Recommendations: For Microsoft SQL Server versions 7.0 through 2000, restrict access to the xp runwebtask stored procedure to prevent unauthorized execution. For Microsoft Data Engine (MSDE) version 1.0, limit access to the msdb.dbo.mswebtasks table to minimize the risk of exploitation. For Microsoft Desktop Engine (MSDE) 2000, consider revoking PUBLIC execute permissions on the xp runwebtask stored procedure as a temporary workaround.

Fix

Related Identifiers

CVE-2002-1145

Affected Products

Data Engine

Desktop Engine

Sql Server

References · 8

• http://iss.net/security_center/static/10388.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1145 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-061 · Vendor Advisory
• http://cisco.com/warp/public/707/cisco-sa-20030126-ms02-061.shtml · Vendor Advisory
• http://securityfocus.com/bid/5980 · Note
• http://marc.info/?l=bugtraq&m=103487044122900&w=2 · Note
• http://marc.info/?l=ntbugtraq&m=103486356413404&w=2 · Note
• http://nextgenss.com/advisories/mssql-webtasks.txt · Note