« Volver al listado

CVE-2002-1137

Estado: ModificadaAlta (7.5)—

Buffer overflow in the Database Console Command (DBCC) that handles user inputs in Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, allows attackers to execute arbitrary code via a long SourceDB argument in a "non-SQL OLEDB data source" such as FoxPro, a variant of CAN-2002-0644.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — Data EngineMicrosoft — SQL Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2002-1137",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2002-10-11T04:00:00.000",
  "references": [
    {
      "url": "http://www.ciac.org/ciac/bulletins/n-003.shtml",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.cisco.com/warp/public/707/cisco-sa-20030126-ms02-061.shtml",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.scan-associates.net/papers/foxpro.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/5877",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/10255",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ciac.org/ciac/bulletins/n-003.shtml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.cisco.com/warp/public/707/cisco-sa-20030126-ms02-061.shtml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.scan-associates.net/papers/foxpro.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/5877",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/10255",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer overflow in the Database Console Command (DBCC) that handles user inputs in Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, allows attackers to execute arbitrary code via a long SourceDB argument in a \"non-SQL OLEDB data source\" such as FoxPro, a variant of CAN-2002-0644."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de búfer en la Consola de Comandos de Base de Datos (CBCC) que maneja la entrada de usuario en Microsoft SQL Server 7.0 y 2000, incluyendo Microsoft Data Engine (MSDE) y Microsoft Desktop Engine (MSDE) 2000, permite a atantes ejecutar código arbitrario, una variante de CAN-2002-0644."
    }
  ],
  "lastModified": "2026-06-16T21:58:47.570",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:data_engine:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F455C373-A9F7-47F9-828E-DEE2C8CC6545"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:data_engine:2000:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51ABD323-BF3F-4825-8788-8FCD614E83E4"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2AB95D7-394E-423B-884C-87A9960682EE"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:7.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4355BA3D-B985-4DC7-AD9D-21B64652CC19"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:7.0:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D590A237-1587-4FF2-BEEA-F96B1C08F84C"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:7.0:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B004F338-1C8E-4283-8823-1A16A291FCBD"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:7.0:sp4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54EB3111-B93A-4577-9592-0D13FE7FD2C4"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5D559EE-727C-405C-987C-247973A84D32"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2000:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A74EBC1-FD61-4DD1-AC8A-E4B0F333A980"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2000:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BC2A389-68BF-45B1-833D-96B331844424"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}