CVE-2002-1138

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own privileges instead of the entity that launched it, which allows attackers to overwrite system files, aka "Flaw in Output File Handling for Scheduled Jobs."

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Oct 11, 2002
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2002

CVE-2002-11395.0The Compressed Folders feature in Microsoft Windows 98 with Plus! Pack, Windows Me, and Windows XP does not properly check the destination fCVE-2002-11405.0The Sun Microsystems RPC library Services for Unix 3.0 Interix SD, as implemented on Microsoft Windows NT4, 2000, and XP, allows remote attaCVE-2002-11415.0An input validation error in the Sun Microsystems RPC library Services for Unix 3.0 Interix SD, as implemented on Microsoft Windows NT4, 200CVE-2002-11427.5Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and InterCVE-2002-11435.0Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the CVE-2002-114510.0The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and MiCVE-2002-11465.0The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, use the maximumCVE-2002-11477.1The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16, with stacking features and remote administration enaCVE-2002-11485.0The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read souCVE-2002-11495.0The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive CVE-2002-11504.6The Remote Desktop Sharing (RDS) Screen Saver Protection capability for Microsoft NetMeeting 3.01 through SP2 (4.4.3396) allows attackers wiCVE-2002-11517.5The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames
CVE-2002-1138: High severity, CVSS 7.5 | Vulnix