Detections
Analytics
MS02-035: MS SQL Installation may leave passwords on system (263968)
medium Nessus Plugin ID 11322
Synopsis
It may be possible to get the remote SQL Server's administrator password.Description
The installation process for the remote MS SQL Server left files named 'setup.iss' on the remote host. These files contain the password assigned to the 'sa' account of the remote database.An attacker who manages to view these files may be able to leverage this issue to gain full administrative access to the application.
Solution
Microsoft has released a set of patches for SQL Server 7 and 2000.See Also
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2002/ms02-035
Plugin Details
Severity: Medium
ID: 11322
File Name: smb_nt_ms02-035.nasl
Version: 1.45
Type: local
Agent: windows
Family: Windows : Microsoft Bulletins
Published: 3/6/2003
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.4
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:microsoft:sql_server
Required KB Items: SMB/MS_Bulletin_Checks/Possible
Exploit Ease: No known exploits are available
Patch Publication Date: 7/10/2002
Vulnerability Publication Date: 7/10/2002
Reference Information
CVE: CVE-2002-0643
BID: 5203