Re: MS-SQL Blank Password Enumeration

From: Chip Andrews (chipandrews@usa.net)
Date: 05/28/02 

From: "Chip Andrews" <chipandrews@usa.net>
To: "Don Wolf" <don.wolf@securedsite.org>, "Focus-MS - Security Focus" <focus-ms@securityfocus.com>
Date: Mon, 27 May 2002 19:50:14 -0400

Brian,

Databases don't have passwords - logins do. I think what you may be asking
is how do I determine if other "instances" of SQL Server exist on the
machine and do any of those have blank 'sa' passwords. You can use SQLPing
2.2 at http://www.sqlsecurity.com or App Detective at
http://www.appsecinc.com - both apps will detect multiple instances and
check each instance for a blank (or weak) 'sa' account passwords.

Chip
www.sqlsecurity.com

----- Original Message -----
From: "Don Wolf" <securedsite@hotmail.com>
To: "Focus-MS - Security Focus" <focus-ms@securityfocus.com>
Sent: Monday, May 27, 2002 3:30 PM
Subject: MS-SQL Blank Password Enumeration

>
> Greetings All, a quick question for any MS-SQL folks:
>
> How can I determine which databases have blank passwords on SQL servers
with
> multiple databases? I've already determined the servers which contain
blank
> passwords, but the tool I am using (sqlbf.c) doesn't display the
individual
> database, e.g. Northwind, etc. On one particular server we have 5
databases
> and I need to determine which is running blank and what dept. will need to
> fix it. I am asking this question assuming the SA account is not global
and
> is configured on each individual database?
>
> Any assistance would be greatly appreciated.
>
> Brian.
>

Relevant Pages

  • RE: New Paper: Microsoft SQL Server Passwords
    ... > Subject: New Paper: Microsoft SQL Server Passwords ... are stored in Microsoft's SQL Server. ... If you select a case-insensitive collation for your SQL Server ... Drop all of the user databases. ...
    (Bugtraq)
  • Re: Username and password table
    ... And you can import hidden tables to other databases ... > "Bexar1" wrote: ... >>>> I want to make a table that holds all the usernames and passwords. ... I know access has it's own security system, ...
    (microsoft.public.access.security)
  • Re: Open DB using OLE DB
    ... In the DataSource setup, once the user enter the server name, it will ... Can I get the list of databases available ... May I know why do you recommend getting away from user IDs and passwords ... > Windows Authentication instead, ...
    (microsoft.public.vb.general.discussion)
  • Re: This is exactly what happened to me, whats the solution?
    ... > If I reinstall SQL Server, ... The SQL Server install does not impact user databases at all. ... >>> Servers on the network they disallowed blank passwords. ...
    (microsoft.public.sqlserver.security)
  • Re: PINs Password Management
    ... > I use Vault to store network configuration information and PINs for password ... but I keep the executables and databases on an IBM memory key ... My less often used passwords stay in there. ...
    (Security-Basics)
Loading