September 4, 2002 at 8:06 am
Another one from NGSSoftware:
http://www.nextgenss.com/advisories/mssql-sp_MSSetServerProperties.txt
The attacker can use sp_MSSetServerProperties to set whether or not SQL Server starts automatically when the system comes up. sp_MSsetalertinfo can be used to change alert delivery.
Recommended fix from advisory:
use master
go
drop execute on [sp_MSSetServerProperties] to [public]
go
drop execute on [sp_MSsetalertinfo] to [public]
go
K. Brian Kelley
http://www.truthsolutions.com/
Author: Start to Finish Guide to SQL Server Performance Monitoring
http://www.netimpress.com/shop/product.asp?ProductID=NI-SQL1
K. Brian Kelley
@kbriankelley
September 4, 2002 at 8:24 am
Just a quick fix to the t-sql (which David from NGSoftware has now put live at the above link)
use master
go
revoke execute on [sp_MSSetServerProperties] to [public]
go
revoke execute on [sp_MSsetalertinfo] to [public]
go
Steven
September 4, 2002 at 10:30 am
Good catch. Teach me to try and copy and paste without first checking while doing something else.
K. Brian Kelley
http://www.truthsolutions.com/
Author: Start to Finish Guide to SQL Server Performance Monitoring
http://www.netimpress.com/shop/product.asp?ProductID=NI-SQL1
K. Brian Kelley
@kbriankelley
September 4, 2002 at 2:53 pm
Not to worry. I picked up nextgenss on that.
Hence the fixed code being posted on there site 🙂
Steven
Viewing 4 posts - 1 through 3 (of 3 total)
You must be logged in to reply to this topic. Login to reply