CVE-2002-0721 Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and possibly remote att...
HighCVSS 10.0
EPSS 46.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and possibly remote attackers, to run stored procedures with administrator privileges via (1) xp_execresultset, (2) xp_printstatements, or (3) xp_displayparamstmt.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft data engine | = 1.0 | No fix listed |
| Microsoft data engine | = 2000 | No fix listed |
| Microsoft sql server | = 7.0 | No fix listed |
| Microsoft sql server | = 7.0-sp1 | No fix listed |
| Microsoft sql server | = 7.0-sp2 | No fix listed |
| Microsoft sql server | = 7.0-sp3 | No fix listed |
| Microsoft sql server | = 7.0-sp4 | No fix listed |
| Microsoft sql server | = 2000 | No fix listed |
| Microsoft sql server | = 2000-sp1 | No fix listed |
| Microsoft sql server | = 2000-sp2 | No fix listed |
References
- 20020815 Alert: Microsoft Security Bulletin - MS02-043 mailing-list
- 20020816 Microsoft SQL Server Extended Stored Procdure privilege upgrade vulnerabilities (#NISR15002002A) mailing-list
- 20020816 Microsoft SQL Server Extended Stored Procdure privilege upgrade vulnerabilities (#NISR15002002A) mailing-list
- VU#399531 third-party-advisory us-government-resource
- VU#818939 third-party-advisory us-government-resource
- VU#939675 third-party-advisory us-government-resource
- www.ngssoftware.com
- MS02-043 vendor-advisory