National Vulnerability Database (CVE-2000-1209)

National Cyber-Alert System Vulnerability Summary: CVE-2000-1209
Orirignal release date: 2002-08-12 Source: US-CERT/NIST ### Overview The &quot;sa&quot; account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida. ### Impact CVSS Severity: 10 (High) Range: remote Authentication: config Impact Type: sec_prot admin="1" ### Reference to Advisories, Solutions, and Tools External Source: CERT Name: Microsoft SQL Server and Microsoft Data Engine (MSDE) ship with a null default password Hyperlink: http://www.kb.cert.org/vuls/id/635463 External Source: Security Focus Name: bid 4797 Hyperlink: http://online.securityfocus.com/bid/4797 External Source: ISS X-Force Name: mssql-no-sapassword(1459) Hyperlink: http://www.iss.net/security_center/static/1459.php External Source: BUGTRAQ Name: 20000815 MS-SQL & Hyperlink: http://security-archive.merton.ox.ac.uk/bugtraq-200008/0233.html External Source: MSKB Name: %5BLN%5D Hyperlink: http://support.microsoft.com/default.aspx?scid=kb External Source: MSKB Name: EN-US Hyperlink: http://support.microsoft.com/default.aspx?scid=kb External Source: CONFIRM Name: http://www.microsoft.com/security/security_bulletins/ms02020_sql.asp Hyperlink: http://www.microsoft.com/security/security_bulletins/ms02020_sql.asp External Source: BID Name: 4797 Hyperlink: http://www.securityfocus.com/bid/4797 External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: BUGTRAQ Name: 20020522 Opty-Way Enterprise includes MSDE with sa & Hyperlink: http://online.securityfocus.com/archive/1/273639 ### Vulnerable Software and Vendor MSDE (Microsoft) SQL Server Desktop Engine (Microsoft) Insight Manager XE (Compaq) Insight Manager (Compaq) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1209