Unscored severity · published Jul 23, 2002
CVE-2002-0643
The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after…
–
CVSS
1.7%
EPSS
No
On KEV
Description
The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka "SQL Server Installation Process May Leave Passwords on System."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Data Engine · Microsoft
1.0 · source: NVD
SS
Sql Server · Microsoft
7.0; 7.0; 7.0; 7.0; 2000; 2000; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0643
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0643
marc.info
http://marc.info/?l=bugtraq&m=102640092826731&w=2
marc.info
http://marc.info/?l=vuln-dev&m=102640394131103&w=2
US Government Resource
http://www.kb.cert.org/vuls/id/338195
www.securityfocus.com
http://www.securityfocus.com/bid/5203
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-035
More from Data Engine
–
CVE-2008-0086
Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to…
–
CVE-2008-0085
SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine…
–
CVE-2008-0107
Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE);…
–
CVE-2008-0106
Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert…
–
CVE-2003-0232
Microsoft SQL Server 7, 2000, and MSDE allows local users to execute arbitrary code via a certain request to the Local Procedure Calls (LPC) port that leads to a buffer overflow