PT-2009-4786 · Microsoft+1 · Windows+2

Tim Brown · Published 2009-07-07 · Updated 2018-10-10 · CVE-2009-2357

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TekRADIUS version 3.0

Description The default configuration of TekRADIUS uses the sa account to communicate with Microsoft SQL Server, making it easier for remote attackers to obtain privileged access to the database and the underlying Windows operating system.

Recommendations For TekRADIUS version 3.0, consider changing the default configuration to use a less privileged account for communication with Microsoft SQL Server to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2009-2357

Affected Products

Sql Server

Tekradius

Windows

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2009-2357 · Security Note
• http://vupen.com/english/advisories/2009/1816 · Note
• http://nth-dimension.org.uk/utils/get.php?downloadsid=56 · Note
• http://securityfocus.com/archive/1/504740/100/0/threaded · Note