critical10.0Public exploit code
CVE-2002-0721
Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow un…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft SQL 2000/7.0 - Agent Jobs Privilege Escalation2002-08-15 · remote · windows · Verified
Impact
Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and possibly remote attackers, to run stored procedures with administrator privileges via (1) xp_execresultset, (2) xp_printstatements, or (3) xp_displayparamstmt.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Data Engine | Versions 1.0, 2000 |
| Microsoft | Sql Server | Versions 7.0, 2000 |
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0087.html
- http://marc.info/?l=bugtraq&m=102950473002959&w=2
- http://marc.info/?l=ntbugtraq&m=102950792606475&w=2
- http://www.kb.cert.org/vuls/id/399531
- http://www.kb.cert.org/vuls/id/818939
- http://www.kb.cert.org/vuls/id/939675
- http://www.ngssoftware.com/advisories/mssql-esppu.txt
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-043
- http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0087.html
- http://marc.info/?l=bugtraq&m=102950473002959&w=2
- http://marc.info/?l=ntbugtraq&m=102950792606475&w=2
- http://www.kb.cert.org/vuls/id/399531
- http://www.kb.cert.org/vuls/id/818939
- http://www.kb.cert.org/vuls/id/939675
- http://www.ngssoftware.com/advisories/mssql-esppu.txt
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-043