Vulnerability Name:

CVE-2000-0772 (CCN-5072)

Assigned:2000-08-09
Published:2000-08-09
Updated:2017-12-19
Summary:The installation of Tumbleweed Messaging Management System (MMS) 4.6 and earlier (formerly Worldtalk Worldsecure) creates a default account "sa" with no password.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: Request for Comment document RFC 1244
Site Security Handbook

Source: BUGTRAQ
Type: Vendor Advisory
20000810 Tumbleweed Worldsecure (MMS) BLANK 'sa' account password vulnerability

Source: CCN
Type: BugTraq Mailing List, Thu Aug 10 2000 - 11:36:36 CDT
Tumbleweed Worldsecure (MMS) BLANK 'sa' account password vulnerability

Source: CCN
Type: BugTraq Mailing List, Fri Aug 11 2000 - 16:32:05 CDT
Re: Tumbleweed Worldsecure (MMS) BLANK 'sa' account password vuln erability

Source: MITRE
Type: CNA
CVE-2000-0772

Source: MITRE
Type: CNA
CVE-2000-1209

Source: CCN
Type: BugTraq Mailing List, 2000-08-16 12:17:13
Released Patch: Tumbleweed Worldsecure (MMS) BLANK 'sa' account password

Source: CCN
Type: Tumbleweed (MMS) Technical Support
Technical Support Bulletin Update

Source: CONFIRM
Type: UNKNOWN
http://thompson.tumbleweed.com/NewKB/bulletin/UPFiles/sa-official.htm

Source: CCN
Type: US-CERT VU#635463
Microsoft SQL Server and Microsoft Data Engine (MSDE) ship with a null default password

Source: CCN
Type: OSVDB ID: 13252
Tumbleweed Messaging Management System Default Admin Account

Source: CCN
Type: OSVDB ID: 3570
Compaq Insight Manager Default Password

Source: BID
Type: Patch, Vendor Advisory
1562

Source: CCN
Type: BID-1562
Tumbleweed MMS No Default Password Vulnerability

Source: CCN
Type: BID-4797
Microsoft MSDE/SQL Server 2000 Desktop Engine Default Configuration Vulnerability

Source: XF
Type: UNKNOWN
tumbleweed-mms-blank-password(5072)

Source: XF
Type: UNKNOWN
tumbleweed-mms-blank-password(5072)

Source: CCN
Type: Microsoft Knowledge Base Article 313418
PRB: Unsecured SQL Server with Blank (NULL) SA Password Leaves Vulnerability to a Worm

Vulnerable Configuration:Configuration 1:
  • cpe:/a:tumbleweed:messaging_management_system:4.3:*:*:*:*:*:*:*
  • OR cpe:/a:tumbleweed:messaging_management_system:4.5:*:*:*:*:*:*:*
  • OR cpe:/a:tumbleweed:messaging_management_system:4.6:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:tumbleweed:messaging_management_system:4.3:*:*:*:*:*:*:*
  • OR cpe:/a:tumbleweed:messaging_management_system:4.5:*:*:*:*:*:*:*
  • OR cpe:/a:tumbleweed:messaging_management_system:4.6:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    tumbleweed messaging management system 4.3
    tumbleweed messaging management system 4.5
    tumbleweed messaging management system 4.6
    tumbleweed messaging management system 4.3
    tumbleweed messaging management system 4.5
    tumbleweed messaging management system 4.6