Re: Microsoft SQL Server password cracking

From: Ben Hutchings (ben.hutchings@ROUNDPOINT.COM)
Date: 07/10/02 

Date:         Wed, 10 Jul 2002 21:22:14 +0100
From: Ben Hutchings <ben.hutchings@ROUNDPOINT.COM>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

On Wed, 10 Jul 2002, Deus, Attonbitus wrote:
<snip>
> As described in a paper by Chris Anley,
> http://www.nextgenss.com/papers/violating_database_security.pdf,
> a regular user can employ a simple binary patch to client-side apps using
> the ExectuionContext::UID function to explicitly return "UID 1" to table
> selects, thus giving any user "SA" rights to the table. If the user can
> log on, the user can get to any table.

You have misunderstood what the paper says. The patch is for the server
executable (or the in-memory image); SQL Server may have poor security but
it doesn't rely on client-side authentication! So it would be a useful
payload for a buffer overflow exploit, but it does not in itself represent
a vulnerability.

<snip>
> Even if only true SA could get the hashes,

Which still seems to be the case.

> it still allows an attacker much more information than they should be
> able to get- it is similar to pwdump2- you have to be admin on the box
> to use it, but once you get the data, you find that compromising other
> machines downrange is much easier.

Agreed.

Relevant Pages

  • Re: Migrating away from MS-Access
    ... that, in fact, the amount of information being sent *is* smaller. ... convert the back end to SQL Server and fix the Access ... I do think that it is definitly the case the front end needs a 70-80% rewrite to work with sqlserver There must be reasons why people develop in VB.net. ...
    (comp.databases.ms-access)
  • Re: Ideas for software
    ... Paavo P wrote: ... >>Rather than force everyone to download the file, ... does anyone have or know of a good binary patch system? ...
    (comp.programming)
  • Re: Update question
    ... Hi Simon, ... Yes, it is allowed by SQL Server, though it is on violation of relational ...
    (microsoft.public.sqlserver.programming)
  • Re: Modelling objects with variable number of properties in an RDBMS
    ... >I know that, but what recipe does Roy suggest for, let's say, MS SQL Server ... >that does not have either UDTs or other means to implement an entity with a ... Are you saying that SQL Server can not model a one-to-one ...
    (comp.databases.theory)
  • Re: Extracting Duplicates from SQL Server 2000
    ... Here is the query that I used. ... a few well-chosen rows of sample data (as ... My SQL Server blog: http://sqlblog.com/blogs/hugo_kornelis ...
    (comp.databases.ms-sqlserver)