Microsoft SQL Server Permissions Vulnerability in Aid of Remote Attacks

CVE-2002-0721

Summary

Microsoft SQL Server 7.0 and 2000 are susceptible to a permissions misconfiguration that allows unprivileged users to invoke extended stored procedures. The vulnerability arises from weak permissions set for procedures linked with helper functions, specifically through xp_execresultset, xp_printstatements, and xp_displayparamstmt. This setup can enable unauthorized execution of these stored procedures with administrative privileges, potentially compromising the security of the database system.

References