{"api_version":"1","generated_at":"2026-07-23T04:17:59+00:00","cve":"CVE-2002-0643","urls":{"html":"https://cve.report/CVE-2002-0643","api":"https://cve.report/api/cve/CVE-2002-0643.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2002-0643","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2002-0643"},"summary":{"title":"CVE-2002-0643","description":"The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka \"SQL Server Installation Process May Leave Passwords on System.\"","state":"PUBLISHED","assigner":"mitre","published_at":"2002-07-23 04:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.6","severity":"","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","baseScore":4.6,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://marc.info/?l=vuln-dev&m=102640394131103&w=2","name":"http://marc.info/?l=vuln-dev&m=102640394131103&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'SQL Server 7 & 2000 Installation process and Service Packs write encoded passwords to a file' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=102640092826731&w=2","name":"http://marc.info/?l=bugtraq&m=102640092826731&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'SQL Server 7 & 2000 Installation process and Service Packs write encoded passwords to a file' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-035","name":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-035","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Security Bulletin MS02-035 - Moderate | Microsoft Docs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/338195","name":"http://www.kb.cert.org/vuls/id/338195","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"CERT/CC Vulnerability Note VU#338195","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/5203","name":"http://www.securityfocus.com/bid/5203","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft MS-SQL Server Installation Password Caching Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2002-0643","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0643","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2002","cve_id":"643","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"data_engine","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"643","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"sql_server","cpe6":"2000","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"643","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"sql_server","cpe6":"2000","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"643","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"sql_server","cpe6":"2000","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"643","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"sql_server","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"643","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"sql_server","cpe6":"7.0","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"643","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"sql_server","cpe6":"7.0","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"643","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"sql_server","cpe6":"7.0","cpe7":"sp3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T02:56:38.278Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20020711 SQL Server 7 & 2000 Installation process and Service Packs write encoded passwords to a file","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=102640092826731&w=2"},{"name":"MS02-035","tags":["vendor-advisory","x_refsource_MS","x_transferred"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-035"},{"name":"20020711 SQL Server 7 & 2000 Installation process and Service Packs write encoded passwords to a file","tags":["mailing-list","x_refsource_VULN-DEV","x_transferred"],"url":"http://marc.info/?l=vuln-dev&m=102640394131103&w=2"},{"name":"VU#338195","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/338195"},{"name":"5203","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/5203"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2002-07-11T00:00:00.000Z","descriptions":[{"lang":"en","value":"The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka \"SQL Server Installation Process May Leave Passwords on System.\""}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-12T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20020711 SQL Server 7 & 2000 Installation process and Service Packs write encoded passwords to a file","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=102640092826731&w=2"},{"name":"MS02-035","tags":["vendor-advisory","x_refsource_MS"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-035"},{"name":"20020711 SQL Server 7 & 2000 Installation process and Service Packs write encoded passwords to a file","tags":["mailing-list","x_refsource_VULN-DEV"],"url":"http://marc.info/?l=vuln-dev&m=102640394131103&w=2"},{"name":"VU#338195","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/338195"},{"name":"5203","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/5203"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2002-0643","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka \"SQL Server Installation Process May Leave Passwords on System.\""}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20020711 SQL Server 7 & 2000 Installation process and Service Packs write encoded passwords to a file","refsource":"BUGTRAQ","url":"http://marc.info/?l=bugtraq&m=102640092826731&w=2"},{"name":"MS02-035","refsource":"MS","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-035"},{"name":"20020711 SQL Server 7 & 2000 Installation process and Service Packs write encoded passwords to a file","refsource":"VULN-DEV","url":"http://marc.info/?l=vuln-dev&m=102640394131103&w=2"},{"name":"VU#338195","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/338195"},{"name":"5203","refsource":"BID","url":"http://www.securityfocus.com/bid/5203"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2002-0643","datePublished":"2002-07-12T04:00:00.000Z","dateReserved":"2002-06-28T00:00:00.000Z","dateUpdated":"2024-08-08T02:56:38.278Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2002-07-23 04:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","baseScore":4.6,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:data_engine:1.0:*:*:*:*:*:*:*","matchCriteriaId":"F455C373-A9F7-47F9-828E-DEE2C8CC6545"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:7.0:*:*:*:*:*:*:*","matchCriteriaId":"A2AB95D7-394E-423B-884C-87A9960682EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:7.0:sp1:*:*:*:*:*:*","matchCriteriaId":"4355BA3D-B985-4DC7-AD9D-21B64652CC19"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:7.0:sp2:*:*:*:*:*:*","matchCriteriaId":"D590A237-1587-4FF2-BEEA-F96B1C08F84C"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:7.0:sp3:*:*:*:*:*:*","matchCriteriaId":"B004F338-1C8E-4283-8823-1A16A291FCBD"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*","matchCriteriaId":"A5D559EE-727C-405C-987C-247973A84D32"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:2000:sp1:*:*:*:*:*:*","matchCriteriaId":"4A74EBC1-FD61-4DD1-AC8A-E4B0F333A980"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:2000:sp2:*:*:*:*:*:*","matchCriteriaId":"4BC2A389-68BF-45B1-833D-96B331844424"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2002","CveId":"643","Ordinal":"1","Title":"CVE-2002-0643","CVE":"CVE-2002-0643","Year":"2002"},"notes":[{"CveYear":"2002","CveId":"643","Ordinal":"1","NoteData":"The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka \"SQL Server Installation Process May Leave Passwords on System.\"","Type":"Description","Title":"CVE-2002-0643"},{"CveYear":"2002","CveId":"643","Ordinal":"2","NoteData":"2002-07-12","Type":"Other","Title":"Published"},{"CveYear":"2002","CveId":"643","Ordinal":"3","NoteData":"2018-10-12","Type":"Other","Title":"Modified"}]}}}