CVE-2000-0402: Low severity Microsoft SQL Server vulnerability
The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack Password" vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable Mixed Mode authentication in SQL Server and configure the instance to use Windows Authentication only to prevent the server from storing the 'sa' account password in plaintext.
Microsoft SQL Server Authentication mode = Disable Mixed Mode (use Windows Authentication only) - Compensating control
Restrict file system permissions on SQL Server log files so only authorized administrators can read them, and locate and securely delete or archive any logs that contain plaintext passwords.
- Operational
Rotate the 'sa' account password and any other credentials that may have been exposed in plaintext; apply new strong passwords and update any dependent services.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0402?
CVE-2000-0402 is classified as a critical vulnerability due to the exposure of sensitive credentials.
How do I fix CVE-2000-0402?
To fix CVE-2000-0402, users should upgrade to a newer version of Microsoft SQL Server that does not store the 'sa' account password in plaintext.
What versions of SQL Server are affected by CVE-2000-0402?
CVE-2000-0402 affects Microsoft SQL Server 7.0, including service packs SP1 and SP2.
What are the potential risks of CVE-2000-0402?
The potential risks of CVE-2000-0402 include unauthorized access to the SQL Server by exposing the 'sa' password to any user with access to the log file.
Is there a workaround for CVE-2000-0402?
Disabling Mixed Mode authentication can serve as a temporary workaround for CVE-2000-0402 until the software is upgraded.