CVE-2002-0642

published 2002-07-23

CVE-2002-0642: The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000…

Priority P3 35 high 7.2 CVSS 2.0

AV L AC L Au N C C I C A C

The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key."

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	msde	—	—
microsoft	sql_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 139↗

port 1433↗

snort↗

alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"GPL NETBIOS xp_reg* registry access"; flow:established,to_server; content:"x|00|p|00|_|00|r|00|e|00|g|00|"; depth:32; offset:32; nocase; reference:bugtraq,5205; reference:cve,2002-0642; reference:nessus,10642; reference:url,www.microsoft.com/technet/security/bulletin/MS02-034; classtype:attempted-user; sid:2100689; rev:13; metadata:created_at 2010_09_23, cve CVE_2002_0642, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

snort↗

alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"GPL NETBIOS xp_reg* - registry access"; flow:established,to_server; content:"x|00|p|00|_|00|r|00|e|00|g|00|"; nocase; reference:bugtraq,5205; reference:cve,2002-0642; reference:nessus,10642; reference:url,www.microsoft.com/technet/security/bulletin/MS02-034; classtype:attempted-user; sid:2100686; rev:12; metadata:created_at 2010_09_23, cve CVE_2002_0642, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

bytes↗

x|00|p|00|_|00|r|00|e|00|g|00|

• → Detect Unicode-encoded 'xp_reg' extended stored procedure calls inbound to SQL Server on port 1433 (SQL native) and port 139 (NETBIOS/SMB); the byte pattern x|00|p|00|_|00|r|00|e|00|g|00| represents the UTF-16LE encoding of the prefix common to all xp_reg* registry-access stored procedures. ↗
• → On port 139, apply depth:32 and offset:32 constraints to reduce false positives — the xp_reg* pattern is expected at a fixed position within the NETBIOS session payload. ↗
• → Match only established, client-to-server flows (flow:established,to_server) to avoid alerting on server responses or unrelated traffic. ↗
• → The vulnerability involves insecure permissions on the SQL Server service account registry key; monitor local registry access/modification events on keys associated with the SQL Server service account as a host-based detection complement. ↗

• · The Snort rules classify these alerts as 'attempted-user' / Informational severity; tune thresholds appropriately as xp_reg* calls may occur in legitimate administrative contexts and generate noise. ↗
• · The $SQL_SERVERS variable must be correctly scoped in the Snort/Suricata configuration to cover all MSSQL 2000 / MSDE 2000 hosts; missing hosts in this variable will result in blind spots. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.