CVE-2002-0866

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs (dynamic link libraries) via a Java applet that calls the constructor for com.ms.jdbc.odbc.JdbcOdbc with the desired DLL terminated by a null string, aka "DLL Execution via JDBC Classes."

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2002-09/0271.html
http://www.iss.net/security_center/static/10133.phpPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/307306Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/5751
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-052
http://archives.neohapsis.com/archives/bugtraq/2002-09/0271.html
http://www.iss.net/security_center/static/10133.phpPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/307306Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/5751
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-052

Timeline

Published: Oct 11, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-08675.0Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to cause a denial of service (crash) in Internet E CVE-2002-08697.5Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote att CVE-2002-08707.5The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability (CVE-2001-0622) was incomplete, whi CVE-2002-08712.1xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a CVE-2002-08727.5l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions.CVE-2002-08735.0Vulnerability in l2tpd 0.67 allows remote attackers to overwrite the vendor field via a long value in an attribute/value pair, possibly via CVE-2002-08745.0Vulnerability in Interchange 4.8.6, 4.8.3, and other versions, when running in INET mode, allows remote attackers to read arbitrary files.CVE-2002-08752.1Vulnerability in FAM 2.6.8, 2.6.6, and other versions allows unprivileged users to obtain the names of files whose access is restricted to t CVE-2002-08765.0Web server for Shambala 4.5 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request.CVE-2002-08775.0Directory traversal vulnerability in the FTP server for Shambala 4.5 allows remote attackers to read arbitrary files via a .. (dot dot) in t CVE-2002-08787.5SQL injection vulnerability in the login form for LogiSense software including (1) Hawk-i Billing, (2) Hawk-i ASP and (3) DNS Manager allows CVE-2002-08795.0showtemp.cfm for Gafware CFXImage 1.6.6 allows remote attackers to read arbitrary files via (1) a .. or (2) a C: style pathname in the FILE