LiveActive security incident?Get immediate response
CVE Record

CVE-2002-0866: Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 al...

Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs (dynamic link libraries) via a Java applet that calls the constructor for com.ms.jdbc.odbc.JdbcOdbc with the desired DLL terminated by a null string, aka "DLL Execution via JDBC Classes."

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's Takehigh

Analyst readout for executives and security teams

Plain-English summary

This is a legacy Microsoft Virtual Machine issue where a malicious Java applet could cause Windows to load and run a DLL. Business risk is mainly in old environments that still allow Microsoft VM Java applets. The source bundle does not show active exploitation.

Executive priority

Treat as high priority only if legacy Microsoft VM remains in use. For most modern fleets, priority is discovery and retirement planning rather than emergency response, because active exploitation is not shown in the supplied sources.

Technical view

The JDBC classes in Microsoft VM up to and including 5.0.3805 can be abused through com.ms.jdbc.odbc.JdbcOdbc constructor handling. A remote attacker could use a Java applet and a null-terminated DLL name to trigger DLL loading and execution.

Likely exposure

Likely exposure is limited to legacy Windows/browser stacks retaining Microsoft VM version 5.0.3805 or earlier with Java applet execution reachable. Modern environments are unlikely to be exposed, but legacy business applications may preserve this runtime.

Exploitation context

The CVE describes remote attack through a Java applet. The provided data marks CISA KEV as false and includes no cited evidence of active exploitation. Public vulnerability database and advisory references exist, but exploit availability is not established here.

Researcher notes

The affected product metadata is incomplete, but the description identifies Microsoft VM through version 5.0.3805. Analysis should stay tied to MS02-052, CERT VU#307306, and the applet-based JDBC DLL-loading behavior. No CVSS, CWE, or KEV evidence is provided.

Mitigation direction

  • Inventory systems for Microsoft VM 5.0.3805 or earlier.
  • Review Microsoft MS02-052 and apply vendor-recommended updates or workarounds.
  • Disable legacy Java applet execution where it is not operationally required.
  • Retire or isolate systems that require the affected Microsoft VM.

Validation and detection

  • Confirm whether Microsoft VM is installed and identify its version.
  • Check browsers and legacy apps for Java applet dependency.
  • Verify MS02-052 guidance has been applied on affected hosts.
  • Prioritize review of externally reachable or user-browsing systems.
Prepared
Confidence
medium
Sources
6

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2002-0866 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.