Vulnerability record · CVE-2002-0642 · published 23 July 2002
CVE-2002-0642: Microsoft SQL Server 2000 service account registry key has insecure permissions
Microsoft · Msde
The registry key holding SQL Server service account credentials in Microsoft SQL Server 2000 and MSDE 2000 has insecure permissions, exposing the account information to local users. Because the stored credentials are readable, a local attacker can use them to escalate privileges on the host. The record does not specify which registry path or permission setting is at fault.
Description
The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key."
AV:L/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityThe flaw gives a local user complete control of the host with low attack complexity and no authentication, and the affected products are long out of support, though no confirmed exploitation is documented.
What it is
The registry key holding SQL Server service account credentials in Microsoft SQL Server 2000 and MSDE 2000 has insecure permissions, exposing the account information to local users. Because the stored credentials are readable, a local attacker can use them to escalate privileges on the host. The record does not specify which registry path or permission setting is at fault.
Impact
A local attacker gains the SQL Server service account's privileges, which can mean full control over confidentiality, integrity and availability of the affected system. The CVSS vector confirms complete impact across all three categories.
Attack surface
Reached locally: the attacker must already have the ability to log on to the host and read the registry key. No authentication beyond local access and no user interaction are required, per the AV:L/AC:L/Au:N vector.
Exploitation
Not listed in CISA KEV and no reference is tagged as an exploit, so there is no confirmed in-the-wild exploitation. EPSS is high (0.497, 98.8th percentile), indicating elevated predicted likelihood, but that is a model estimate rather than observed activity.
What to do
- Apply Microsoft Security Bulletin MS02-034, which addresses this registry permission flaw.
- Restrict registry permissions on the SQL Server service account key so only administrators and the service account can read it.
- Run SQL Server and MSDE services under a low-privilege dedicated account rather than a highly privileged one.
- Limit interactive logon rights on database hosts to users who genuinely need them.
- Where SQL Server 2000 or MSDE 2000 is no longer supported, migrate to a supported release.
Detection
- Audit the ACL on the SQL Server service account registry key and alert on any change that grants read access to non-administrative users.
- Monitor for local logons or process creation by non-administrative accounts that then access SQL Server service account registry data.
- Baseline registry permission changes on database servers and investigate unexpected modifications.
- Review Windows security logs for privilege escalation activity on hosts running SQL Server 2000 or MSDE 2000.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2002-0642 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2002-0642), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
