CVE-2002-0642
First published: Tue Jul 23 2002(Updated: )
The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft SQL Server Data Engine (MSDE) | =2000 | |
| Microsoft SQL Server | =2000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.cert.org/advisories/CA-2002-22.html
- http://www.kb.cert.org/vuls/id/796313
- http://www.iss.net/security_center/static/9523.php
- http://www.securityfocus.com/bid/5205
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1025
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-034
Frequently Asked Questions
What is the severity of CVE-2002-0642?
CVE-2002-0642 has a medium severity rating due to its potential for privilege escalation in Microsoft SQL Server 2000.
How do I fix CVE-2002-0642?
To fix CVE-2002-0642, you should adjust the permissions on the SQL Server service account registry keys to ensure they are not accessible to unauthorized users.
Which software is affected by CVE-2002-0642?
CVE-2002-0642 affects Microsoft SQL Server 2000 and Microsoft SQL Server Desktop Engine (MSDE) 2000.
Can CVE-2002-0642 be exploited by local users?
Yes, CVE-2002-0642 can be exploited by local users who can access the insecure registry key to gain elevated privileges.
What type of vulnerability is CVE-2002-0642 categorized as?
CVE-2002-0642 is categorized as a vulnerability related to incorrect permission settings on a registry key.
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/microsoft
- canonical/microsoft sql server data engine (msde)
- version/microsoft sql server data engine (msde)/2000
- canonical/microsoft sql server
- version/microsoft sql server/2000