CVE-2000-0485: Low severity Microsoft SQL Server vulnerability
Microsoft SQL Server allows local users to obtain database passwords via the Data Transformation Service (DTS) package Properties dialog, aka the "DTS Password" vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft SQL Server Data Transformation Services (DTS)from your environment.Uninstall or disable the Data Transformation Services (DTS) component if it is not required to prevent exposure of database passwords via the DTS package Properties dialog.
- Configuration
Disable display/storage of database passwords in DTS package Properties (do not save plaintext credentials in DTS packages). Configure DTS/package settings to avoid storing or showing database passwords in the Properties dialog.
Microsoft SQL Server (DTS) display_saved_passwords = false - Compensating control
Restrict local access to systems with DTS installed and limit who can open or modify DTS packages (restrict to trusted administrators via OS and application ACLs).
- Operational
Assume database credentials in DTS packages may have been exposed and rotate/replace any potentially affected database passwords and update dependent services or applications.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0485?
CVE-2000-0485 is considered a moderately severe vulnerability due to its potential to expose sensitive data.
How do I fix CVE-2000-0485?
To fix CVE-2000-0485, ensure you are using an updated version of Microsoft SQL Server that addresses this vulnerability.
Who is affected by CVE-2000-0485?
CVE-2000-0485 affects local users of Microsoft SQL Server versions 6.5 and 7.0.
What kind of data can be exposed by CVE-2000-0485?
CVE-2000-0485 potentially allows local users to obtain database passwords.
Is this vulnerability still a concern today?
While older versions of SQL Server are less commonly used today, CVE-2000-0485 remains a concern for systems that have not been updated.