Re: DENY ALL on system SPs in a database

Mike
Do not let the user access to the master database. Does the account you
connect to have sysadmin privilege?




"Mike" <mikey@xxxxxxxxxxxxx> wrote in message
news:O%23FHnRP7IHA.3672@xxxxxxxxxxxxxxxxxxxxxxx
ALL,

We are currently undergoing a SQL injection attack. While I have denied
all access to system tables in the databases for the account in question,
I was wondering if there is any risk in denying execute rights on all the
system stored procedures in the database as well for this account (which
is a sql account I created for our web applications to use)

We are currently using MSSQL Server 2000 in the windows environment

Thoughts?

Thank you in advance!

Mike


.

Relevant Pages

  • Re: Please! Doesnt anyone know a better way to do this?
    ... account, they need to automatically be directed to the page to enter data ... session variable on the Account page. ... I assume here that you're checking a database when the user attempts to ... When a new user attempts to login or clicks to register, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Best way to parse file into db-type layout?
    ... That's an awful lot of columns to put into a database table, ... The rows are identified by Letter type and an account number (always the ... Off to search for dictionaries and databases now. ... > What you need is a clear appreciation of what you are trying to do ...
    (comp.lang.python)
  • Re: Help with WSS 3.0 Server Farm Config - Backend SQL 2005
    ... I had to use only "sharepoint" to get the ... What interest me though is that the database get created but fails after ... Virtual Server with DBSVR ... an account local to the WEBSVR) to create and access the SQL server, ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Relationships, forms and command buttons
    ... asking how to do a particular thing in terms of the database objects itself. ... If they change their bank account, ... tblIndividuals and tblCAFGAYEDons) with linking tables with an autonumber PK ...
    (microsoft.public.access.gettingstarted)
  • RE: Take This Value and Shove It
    ... because of the way I must acquire the loan account numbers and borrower ... To get that data into the Access database, and keep it updated, I have ... Your subform record source should be tblNotes or a query based on it. ...
    (microsoft.public.access.formscoding)