CVEvulnerability

CVE-2003-0148

7.2 HIGH Published 2003-08-27 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2003-08-27
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C

Description

The default installation of MSDE via McAfee ePolicy Orchestrator 2.0 through 3.0 allows attackers to execute arbitrary code via a series of steps that (1) obtain the database administrator username and encrypted password in a configuration file from the ePO server using a certain request, (2) crack the password due to weak cryptography, and (3) use the password to pass commands through xp_cmdshell.

Affected configurations

• mcafee epolicy orchestrator 2.0 • mcafee epolicy orchestrator 2.5 • mcafee epolicy orchestrator 2.5.1 • mcafee epolicy orchestrator 3.0

References

http://www.atstake.com/research/advisories/2003/a073103-1.txt Patch, Vendor Advisory
http://www.nai.com/us/promos/mcafee/epo_vulnerabilities.asp Patch, Vendor Advisory
http://www.atstake.com/research/advisories/2003/a073103-1.txt Patch, Vendor Advisory
http://www.nai.com/us/promos/mcafee/epo_vulnerabilities.asp Patch, Vendor Advisory