PT-2002-2702 · Microsoft · Sql Server

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-1981

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server versions 2000 through 2000 SP2

Description The issue allows the "public" role to execute certain stored procedures, which enables attackers to modify configuration settings. This includes SQL server startup and alert settings through the execution of the (1) sp MSSetServerProperties or (2) sp MSsetalertinfo stored procedures.

Recommendations For Microsoft SQL Server versions 2000 through 2000 SP2, restrict access to the sp MSSetServerProperties and sp MSsetalertinfo stored procedures to prevent unauthorized configuration changes.

Fix

Related Identifiers

CVE-2002-1981

Affected Products

Sql Server

References · 5

• http://seclists.org/lists/bugtraq/2002/Sep/0009.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1981 · Security Note
• http://ngssoftware.com/advisories/mssql-sp_MSSetServerProperties.txt · Vendor Advisory
• http://securityfocus.com/bid/5604 · Note
• http://iss.net/security_center/static/10012.php · Note