CVE-2002-1981: Medium severity Microsoft SQL Server vulnerability
Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the (1) spMSSetServerProperties or (2) spMSsetalertinfo stored procedures, which allows attackers to modify configuration including SQL server startup and alert settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Deny the EXECUTE permission for the public role on the stored procedures sp_MSSetServerProperties and sp_MSsetalertinfo (for example, revoke or explicitly DENY EXECUTE on dbo.sp_MSSetServerProperties and dbo.sp_MSsetalertinfo to the public role).
Microsoft SQL Server EXECUTE permission on stored procedures sp_MSSetServerProperties and sp_MSsetalertinfo = DENY to public role
Event History
Frequently Asked Questions
What is the severity of CVE-2002-1981?
CVE-2002-1981 is considered a high severity vulnerability due to its potential to allow unauthorized configuration changes in Microsoft SQL Server.
How do I fix CVE-2002-1981?
To fix CVE-2002-1981, it's recommended to upgrade Microsoft SQL Server to a version later than SQL Server 2000 SP2.
What systems are affected by CVE-2002-1981?
CVE-2002-1981 affects Microsoft SQL Server 2000 and its Service Pack 1 and Service Pack 2.
What can attackers do exploiting CVE-2002-1981?
Attackers exploiting CVE-2002-1981 can execute stored procedures that modify critical server configurations, including startup and alert settings.
Is CVE-2002-1981 a known vulnerability?
Yes, CVE-2002-1981 is a publicly documented vulnerability that has been acknowledged in security advisories.