CVE

Id
5111  
CVE No.
CVE-2002-0721  
Status
Candidate  
Description
Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and possibly remote attackers, to run stored procedures with administrator privileges via (1) xp_execresultset, (2) xp_printstatements, or (3) xp_displayparamstmt.  
Phase
Modified (20071101)  
Votes
ACCEPT(4) Armstrong, Baker, Cole, Wall | MODIFY(2) Foat, Frech | NOOP(2) Christey, Cox  
Comments
Foat> The description should list MSDE 1.0 and MSDE 2000 as acknowledged by | Microsoft. | Christey> CERT-VN:VU#818939 | URL:http://www.kb.cert.org/vuls/id/818939 | CERT-VN:VU#939675 | URL:http://www.kb.cert.org/vuls/id/939675 | CERT-VN:VU#399531 | URL:http://www.kb.cert.org/vuls/id/399531 | BID:5481 | URL:http://www.securityfocus.com/bid/5481 | XF:mssql-xp-weak-permissions(9857) | URL:http://www.iss.net/security_center/static/9857.php | Frech> XF:mssql-xp-weak-permissions(9857)  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
26962 5111 CVE-2002-0721 BUGTRAQ:20020816 Microsoft SQL Server Extended Stored Procdure privilege upgrade vulnerabilities (#NISR15002002A)  View
26963 5111 CVE-2002-0721 URL:http://marc.info/?l=bugtraq&m=102950473002959&w=2  View
26964 5111 CVE-2002-0721 NTBUGTRAQ:20020816 Microsoft SQL Server Extended Stored Procdure privilege upgrade vulnerabilities (#NISR15002002A)  View
26965 5111 CVE-2002-0721 URL:http://marc.info/?l=ntbugtraq&m=102950792606475&w=2  View
26966 5111 CVE-2002-0721 NTBUGTRAQ:20020815 Alert: Microsoft Security Bulletin - MS02-043  View
26967 5111 CVE-2002-0721 URL:http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0087.html  View
26968 5111 CVE-2002-0721 MISC:http://www.ngssoftware.com/advisories/mssql-esppu.txt  View
26969 5111 CVE-2002-0721 MS:MS02-043  View
26970 5111 CVE-2002-0721 URL:http://www.microsoft.com/technet/security/bulletin/MS02-043.asp  View
26971 5111 CVE-2002-0721 CERT-VN:VU#399531  View
26972 5111 CVE-2002-0721 URL:http://www.kb.cert.org/vuls/id/399531  View
26973 5111 CVE-2002-0721 CERT-VN:VU#818939  View
26974 5111 CVE-2002-0721 URL:http://www.kb.cert.org/vuls/id/818939  View
26975 5111 CVE-2002-0721 CERT-VN:VU#939675  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
63859 JVNDB-2002-000186 Microsoft SQL Server の拡張ストアドプロシージャに付与されているアクセス権の脆弱性 Microsoft SQL Server に同梱されている特定の拡張ストアドプロシージャには、不必要なアクセス権が与えられている脆弱性が存在します。 CVE-2002-0721 5111 10 http://jvndb.jvn.jp/ja/contents/2002/JVNDB-2002-000186.html  View