CVE-1999-1556: Weak Encryption
Microsoft SQL Server 6.5 uses weak encryption for the password for the SQLExecutiveCmdExec account and stores it in an accessible portion of the registry, which could allow local users to gain privileges by reading and decrypting the CmdExecAccount value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the ACLs on the registry key that stores the CmdExecAccount (SQLExecutiveCmdExec) so that standard/local users cannot read the CmdExecAccount value. Restrict read access to Administrators, SYSTEM and the SQL Server service account only.
Windows Registry (Microsoft SQL Server CmdExecAccount value) Permissions/ACLs on registry key containing CmdExecAccount = remove read access for non-privileged local users; allow only Administrators/System/SQL Server service account - Compensating control
Restrict which users have local accounts or interactive/logon rights on the host running SQL Server; permit only trusted administrative accounts to log on locally to reduce exposure to local users who could read the registry.
- Operational
Change/reset the password for the SQLExecutiveCmdExec (CmdExecAccount) to a strong password. After rotating the credential, verify services that use the account continue to function and update any stored credentials as required.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1556?
The severity of CVE-1999-1556 is considered high due to its potential for privilege escalation through weak encryption.
How do I fix CVE-1999-1556?
To fix CVE-1999-1556, it is recommended to upgrade to a more secure version of Microsoft SQL Server as the encryption method in version 6.5 is inadequate.
Who is affected by CVE-1999-1556?
CVE-1999-1556 affects users running Microsoft SQL Server 6.5, particularly those with access to the registry.
What type of vulnerability is CVE-1999-1556?
CVE-1999-1556 is an encryption vulnerability that allows local users to access sensitive information and escalate privileges.
Can local users exploit CVE-1999-1556?
Yes, local users can exploit CVE-1999-1556 by reading the decrypted password stored in an accessible part of the registry.