CVE-2002-0643

3 documents3 sources
Severity
4.6MEDIUM
EPSS
0.5%
top 32.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft Data EngineMicrosoft SQL Server
Timeline
PublishedJul 23
Latest updateApr 30

Description

The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka "SQL Server Installation Process May Leave Passwords on System."

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages2 packages

▶NVDmicrosoft/sql_server2000, 7.0+1

🔴Vulnerability Details

2
GHSA
GHSA-75g6-rwxg-m7pm: The installation of Microsoft Data Engine 1↗2022-04-30
▶
CVEList
CVE-2002-0643: The installation of Microsoft Data Engine 1↗2002-07-12
▶
CVE-2002-0643 (MEDIUM CVSS 4.6) | The installation of Microsoft Data | cvebase.io