Total vulnerabilities in the database
The default installation of MSDE via McAfee ePolicy Orchestrator 2.0 through 3.0 allows attackers to execute arbitrary code via a series of steps that (1) obtain the database administrator username and encrypted password in a configuration file from the ePO server using a certain request, (2) crack the password due to weak cryptography, and (3) use the password to pass commands through xp_cmdshell.
| Software | From | Fixed in |
|---|---|---|
| mcafee / epolicy_orchestrator | 2.5.1 | 2.5.1.x |
| mcafee / epolicy_orchestrator | 3.0 | 3.0.x |
| mcafee / epolicy_orchestrator | 2.5 | 2.5.x |
| mcafee / epolicy_orchestrator | 2.5-sp1 | 2.5-sp1.x |
| mcafee / epolicy_orchestrator | 2.0 | 2.0.x |