CVE-2002-0643

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2002-07-23 · updated 2026-06-16

Description

The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka "SQL Server Installation Process May Leave Passwords on System."

Affected products

Microsoft Data Engine: 1.0
Microsoft SQL Server: 7.0, 7.0-sp1, 7.0-sp2, 7.0-sp3, 2000, 2000-sp1 (+1)

References

http://marc.info/?l=bugtraq&m=102640092826731&w=2
http://marc.info/?l=vuln-dev&m=102640394131103&w=2
http://www.kb.cert.org/vuls/id/338195
http://www.securityfocus.com/bid/5203
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-035
http://marc.info/?l=bugtraq&m=102640092826731&w=2
http://marc.info/?l=vuln-dev&m=102640394131103&w=2
http://www.kb.cert.org/vuls/id/338195
http://www.securityfocus.com/bid/5203
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-035

Get alerted when CVE-2002-0643 or the next vulnerability affects your stack