Re: Rename xp_cmdshell

From: Gert E.R. Drapers (GertD_at_Online.SQLDev.Net)
Date: 08/02/03 

Date: Fri, 1 Aug 2003 15:33:09 -0700

The person who advised this is completely wrong, you can not rename an
extended stored procedure, because the name of an extended stored procedure
is the physical entrypoint of the function inside the DLL.

My advise, revoke all right to the XP, if somebody for some reason needs
access to it, create a wrapper stored procedure that checks the parameters,
or even better does not accept any parameters so you are in control of what
gets executed.

GertD@SQLDev.Net

Please reply only to the newsgroups.
This posting is provided "AS IS" with no warranties, and confers no rights.
You assume all risk for your use.
Copyright © SQLDev.Net 1991-2003 All rights reserved.

"Danny Cooper" <danny.cooper@bbc.co.uk> wrote in message
news:devhiv0ku7tir2bkblpbhvb6cvj259jtk2@4ax.com...
>
> A number of security papers recommend renaming xp_cmdshell, but when I
> try (in Enterprise Manager as sysadmin) I get "The object cannot be
> renamed". Any ideas?
>
> Danny.
>

Relevant Pages

  • Re: xplog70.dll
    ... What extended stored procedure are you calling from ... >I have a job that executes a DTS-package which in turn call a store procedure ...
    (microsoft.public.sqlserver.security)
  • Re: Logging within User_Defined Functions (UDF)
    ... Despite its name, xp_execresultset is an ordinary stored procedure, not an extended stored procedure. ... Ultimately you can only execute ... > DECLARE @cmdstr nvarchar ...
    (microsoft.public.sqlserver.programming)
  • Enterprise Manager SQL 2K SP3 + Hotfix 0876 Problem
    ... I'm running a local instance of SQL Server 2000 and ... patched to SP3 with Hotfix 0876. ... trying to rename a stored procedure in a local or remote ... Renaming a stored procedure using "sp_rename" from Query ...
    (microsoft.public.sqlserver.tools)
  • Re: Sql Server Trigger that calls Win32.SetEvent
    ... actions outside of SQL Server (or external information) can be ... triggered and returned to SQL Server with an extended stored procedure. ...
    (microsoft.public.sqlserver.server)
  • Distribution Agent Error: Syntax error or access violation
    ... transactional replication. ... The last command which failed is like "CALL ... of the spaces in the stored procedure name which is causing the syntax ... I cant rename the tables to ommit the spaces. ...
    (microsoft.public.sqlserver.replication)