CVE-2000-0202: High severity Microsoft SQL Server vulnerability
Microsoft SQL Server 7.0 and Microsoft Data Engine (MSDE) 1.0 allow remote attackers to gain privileges via a malformed Select statement in an SQL query.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft Data Engine (MSDE)from your environment.Uninstall MSDE if it is not required in your environment to eliminate the vulnerable component.
- Remove
Remove
Microsoft SQL Serverfrom your environment.Uninstall Microsoft SQL Server if it is not required in your environment or replace with an isolated, patched instance once fixes are available.
- Configuration
Disable remote connections to the Database Engine if remote access is not required (turn off network listeners/bind to localhost) to prevent remote exploitation via malformed SQL queries.
Microsoft SQL Server / Microsoft Data Engine (MSDE) remote connections = disabled - Compensating control
Restrict network access to instances of Microsoft SQL Server and MSDE using firewall rules, network ACLs, VPNs or segmentation so only trusted hosts and administrators can reach the database service.
- Operational
Review database and audit logs for suspicious or malformed SELECT statements and signs of privilege escalation; rotate any credentials or service accounts that may have been exposed or elevated prior to implementing mitigations.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0202?
CVE-2000-0202 has a severity rating of high due to its potential for remote privilege escalation.
How do I fix CVE-2000-0202?
To fix CVE-2000-0202, apply the latest patches for Microsoft SQL Server 7.0 and Microsoft Data Engine 1.0.
What types of systems are affected by CVE-2000-0202?
CVE-2000-0202 affects Microsoft SQL Server 7.0 and Microsoft Data Engine (MSDE) 1.0.
Can CVE-2000-0202 be exploited remotely?
Yes, CVE-2000-0202 can be exploited remotely by attackers through a malformed SQL query.
What are the consequences of exploiting CVE-2000-0202?
Exploiting CVE-2000-0202 can allow an attacker to gain elevated privileges on the affected system.