VYPR
Get started
← All advisories
Unrated severityNVD Advisory· Published Oct 11, 2002· Updated Apr 16, 2026

CVE-2002-1138

CVE-2002-1138

Description

Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own privileges instead of the entity that launched it, which allows attackers to overwrite system files, aka "Flaw in Output File Handling for Scheduled Jobs."

Affected products

10
  • Microsoft/Data Engine2 versions
    cpe:2.3:a:microsoft:data_engine:1.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:microsoft:data_engine:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:data_engine:2000:*:*:*:*:*:*:*
  • Microsoft/SQL Server8 versions
    cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*+ 7 more
    • cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:2000:sp1:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:2000:sp2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:7.0:sp1:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:7.0:sp2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:7.0:sp3:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sql_server:7.0:sp4:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.