CVE-2002-0642

The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key."

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.cert.org/advisories/CA-2002-22.html	US Government Resource
http://www.kb.cert.org/vuls/id/796313	US Government Resource
http://www.iss.net/security_center/static/9523.php
http://www.securityfocus.com/bid/5205
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1025
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-034

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:msde:2000:::::::*
	cpe:2.3:a:microsoft:sql_server:2000:::::::*

Information

Published : 2002-07-22 21:00

Updated : 2018-10-12 14:31

NVD link : CVE-2002-0642

Mitre link : CVE-2002-0642

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

microsoft

sql_server
msde

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.cert.org/advisories/CA-2002-22.html", "name": "CA-2002-22", "tags": ["US Government Resource"], "refsource": "CERT"}, {"url": "http://www.kb.cert.org/vuls/id/796313", "name": "VU#796313", "tags": ["US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.iss.net/security_center/static/9523.php", "name": "mssql-registry-insecure-permissions(9523)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/bid/5205", "name": "5205", "tags": [], "refsource": "BID"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1025", "name": "oval:org.mitre.oval:def:1025", "tags": [], "refsource": "OVAL"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-034", "name": "MS02-034", "tags": [], "refsource": "MS"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka \"Incorrect Permission on SQL Server Service Account Registry Key.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2002-0642", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": true, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2002-07-23T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:msde:2000:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-12T21:31Z"}