Unscored severity · published Jul 23, 2002
CVE-2002-0642
The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure…
–
CVSS
48.1%
EPSS
No
On KEV
Description
The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key."
Exploitation
Is it being used?
Exploit prediction (EPSS)48.1% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Msde · Microsoft
2000 · source: NVD
SS
Sql Server · Microsoft
2000 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0642
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0642
US Government Resource
http://www.cert.org/advisories/CA-2002-22.html
www.iss.net
http://www.iss.net/security_center/static/9523.php
US Government Resource
http://www.kb.cert.org/vuls/id/796313
www.securityfocus.com
http://www.securityfocus.com/bid/5205
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-034
oval.cisecurity.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1025
More from Msde
–
CVE-2000-1209
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages…
–
CVE-2002-0624
Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote attackers to gain…
–
CVE-2002-0641
Buffer overflow in bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows attackers with database administration…