VYPR
Get started
← All advisories
Unrated severityNVD Advisory· Published Jul 23, 2002· Updated Apr 16, 2026

CVE-2002-0643

CVE-2002-0643

Description

The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka "SQL Server Installation Process May Leave Passwords on System."

Affected products

8
  • Microsoft/Data Engine
    cpe:2.3:a:microsoft:data_engine:1.0:*:*:*:*:*:*:*
  • Microsoft/Sql Server7 versions
    cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:2000:sp1:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:2000:sp2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:7.0:sp1:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:7.0:sp2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:7.0:sp3:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.