Other thrid party application vendors may include, as part of their distribution, partial versions of MSSQL Server which are vulnerable to the null 'sa' password exploit, but which do not include the client tools necessary to change the password. Please note that these instructions cover full installations of Microsoft SQL Server as distributed by Microsoft Corporation, and versions of Microsoft Data Engine (MSDE) distributed with some third party applications. We recommend that they be periodically audited and checked after system maintenance.įor your convenience we have included below a set of instructions for setting the 'sa' password on Microsoft SQL Servers. Therefore, it is essential that these systems be manually checked to ensure that the passwords are set. Once a connection can be established using the 'sa' or 'probe' accounts, a remote attacker can utilize the xp_cmdshell stored procedure to execute operating system commands in the context of the SYSTEM account in the underlying OS, leaving both the machine and its data completely compromised. Also, some systems may have an additional account named 'probe' which is used in system profiling and performance testing and may also open the system to this vulnerability. Further, there are several conditions under which this password may be reset to null, including applying some system patches, rebuilding the master database, or running an atypical system command sequence. MSSQL Server 2000 defaults to using NT authentication but can also be set to use SQL authentication, opening up the same issue. During the MSSQL Server 6.5 and 7 installations the user is prompted, but not required to set a password on this account. Currently, all versions of Microsoft SQL Server, including SQL 2000, have a potential vulnerability which allows any remote user to obtain Administrator level access to the system through the 'sa' account in the database server.
0 kommentar(er)
