Unscored severity · published Aug 12, 2002
CVE-2000-1209
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages…
–
CVSS
87.3%
EPSS
No
On KEV
Description
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida.
Exploitation
Is it being used?
Exploit prediction (EPSS)87.3% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Data Engine · Microsoft
1.0 · source: NVD
IM
Insight Manager · Compaq
7.0; 7.0 · source: NVD
IM
Insight Manager XE · Compaq
1.1; 1.21; 2.1; 2.1b; 2.1c; 2.2 · source: NVD
MS
Msde · Microsoft
2000 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2000-1209
CVE.org
https://www.cve.org/CVERecord?id=CVE-2000-1209
marc.info
http://marc.info/?l=bugtraq&m=96333895000350&w=2
marc.info
http://marc.info/?l=bugtraq&m=96593218804850&w=2
marc.info
http://marc.info/?l=bugtraq&m=96644570412692&w=2
online.securityfocus.com
http://online.securityfocus.com/archive/1/273639
security-archive.merton.ox.ac.uk
http://security-archive.merton.ox.ac.uk/bugtraq-200008/0233.html
support.microsoft.com
http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ313418