CVE-2000-0323 in Jet
Summary
by MITRE
The Microsoft Jet database engine allows an attacker to modify text files via a database query, aka the "Text I-ISAM" vulnerability.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/19/2026
The CVE-2000-0323 vulnerability represents a critical security flaw in Microsoft Jet database engine that enables remote attackers to manipulate text files through database queries, fundamentally undermining data integrity and system security. This vulnerability specifically affects the text file handling mechanisms within the Jet database engine, which is widely used for database operations across various Microsoft applications including Access and Outlook. The flaw arises from insufficient validation of database queries that reference text files, allowing malicious input to be interpreted as commands that can modify or delete text-based data stored on the system.
The technical nature of this vulnerability stems from the way the Jet engine processes queries that involve text files, particularly when these queries are constructed using the ISAM (Indexed Sequential Access Method) approach for text file access. Attackers can exploit this weakness by crafting specially formatted database queries that bypass normal file access controls and directly manipulate text-based database files. The vulnerability operates at the intersection of database query processing and file system operations, where the engine fails to properly sanitize or validate input parameters that specify text file locations and operations. This creates a path for privilege escalation and unauthorized data modification that can affect both local and networked systems.
The operational impact of CVE-2000-0323 extends beyond simple data corruption, as it can enable attackers to execute arbitrary code, modify critical system files, or gain unauthorized access to sensitive information stored in text-based database formats. This vulnerability is particularly dangerous because it can be exploited remotely through web applications or network services that utilize the Jet database engine, making it a significant threat to enterprise environments where such databases are commonly deployed. The attack surface includes any system that uses Jet database engine for text file operations, including email systems, web applications, and database-driven services that rely on text-based data storage solutions. Organizations using Microsoft Access databases, Outlook personal folders, or any application that leverages the Jet engine for text file processing would be at risk from this vulnerability.
Security professionals should consider this vulnerability in the context of the broader ATT&CK framework, particularly under the techniques related to privilege escalation and data manipulation. The CWE (Common Weakness Enumeration) classification for this vulnerability would likely fall under CWE-20: Improper Input Validation, as the root cause involves insufficient validation of database query parameters. Mitigation strategies should include immediate patch deployment from Microsoft, network segmentation to limit access to vulnerable systems, and implementation of strict database query validation procedures. Organizations should also conduct comprehensive vulnerability assessments to identify all systems using the Jet database engine and implement monitoring solutions to detect suspicious database query patterns that might indicate exploitation attempts. The vulnerability highlights the importance of secure coding practices in database engines and the critical need for input validation mechanisms to prevent unauthorized file system access through database interfaces.