CVE-2003-0148: Weak Encryption
The default installation of MSDE via McAfee ePolicy Orchestrator 2.0 through 3.0 allows attackers to execute arbitrary code via a series of steps that (1) obtain the database administrator username and encrypted password in a configuration file from the ePO server using a certain request, (2) crack the password due to weak cryptography, and (3) use the password to pass commands through xpcmdshell.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0148?
CVE-2003-0148 has a high severity rating due to its potential for arbitrary code execution.
How can I mitigate CVE-2003-0148?
To mitigate CVE-2003-0148, ensure that you are using the latest version of McAfee ePolicy Orchestrator.
What versions of McAfee ePolicy Orchestrator are affected by CVE-2003-0148?
CVE-2003-0148 affects versions 2.0, 2.5, 2.5.1, 3.0, and their respective service packs.
What type of attack does CVE-2003-0148 allow?
CVE-2003-0148 allows attackers to execute arbitrary code by exploiting vulnerabilities in the MSDE installation.
Is CVE-2003-0148 still a risk today?
While CVE-2003-0148 was reported in 2003, it remains a risk for systems that have not been updated or patched properly.