CVE-ID

CVE-2000-0325
Learn more at National Vulnerability Database (NVD)
• CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The Microsoft Jet database engine allows an attacker to execute commands via a database query, aka the "VBA Shell" vulnerability.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
Assigning CNA
MITRE Corporation
Date Record Created
20000511 Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Modified (20020222)
Votes (Legacy)
ACCEPT(5) Armstrong, Baker, Cole, Prosser, Wall
MODIFY(1) Frech
REJECT(1) LeBlanc
REVIEWING(1) Christey
Comments (Legacy) 
 LeBlanc> - same as CVE-1999-1011
   If I'm misunderstanding something here, please correct me.  In fact, it has
   the same bulletin as a reference.
 Frech> XF:jet-vba-shell
 Prosser> This entry is not the same as "now" CVE-1999-1011. That entry is "The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands."  This one should be correct.
 Christey> BUGTRAQ:19990525 Advisory: NT ODBC Remote Compromise
   http://marc.theaimsgroup.com/?l=bugtraq&m=92765973107637&w=2
   NTBUGTRAQ:19990526 Advisory: NT ODBC Remote Compromise
   http://marc.theaimsgroup.com/?l=ntbugtraq&m=92781907215748&w=2
 Christey> The Microsoft advisory itself describes two separate
   vulnerabilities, calling the TEXT I-ISAM problem
   (CVE-2000-0323) a variant of the VBA Shell problem (this
   CAN).  In addition, CVE-2000-0323 does *not* appear in Jet
   4.0, while this one does.  Since one problem appears in a
   different version than the other, CD:SF-LOC suggests keeping
   these candidates SPLIT.
   
   BID:548
   http://www.securityfocus.com/bid/548
 CHANGE> [Christey changed vote from NOOP to REVIEWING]
 Christey> Need to clarify whether the Bugtraq/NTBugtraq posts are
   really describing the same issue (those are BID:286).
Proposed (Legacy)
20000518
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
  
You can also search by reference using the CVE Reference Maps.
For More Information:  CVE Request Web Form (select "Other" from dropdown)
Back to top