Description
The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka "SQL Server Installation Process May Leave Passwords on System."
References (5)
Core 5
Core References
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=102640092826731&w=2
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-035
Mailing List mailing-list
x_refsource_vuln-dev
http://marc.info/?l=vuln-dev&m=102640394131103&w=2
US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/338195
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/5203
Scores
EPSS
0.0170
EPSS Percentile
75.0%
Details
Status
published
Products (3)
microsoft/data_engine
1.0
microsoft/sql_server
7.0 (4 CPE variants)
microsoft/sql_server
2000 (3 CPE variants)
Published
Jul 23, 2002
Tracked Since
Feb 18, 2026