Re: DENY ALL on system SPs in a database

Currently the user does not have rights to the master database and the account does not have any other rights other than dataread and datawrite.

The Injection utilized the web account to read the sysobjects and syscolumns tables in one specific database and then utilize the results to update the data within the tables they found containing text datatypes.

I modified the rights of the web account to explicitly deny all rights to the system tables and that has worked to keep the attacker out.

Mike

Uri Dimant wrote:
Mike
Do not let the user access to the master database. Does the account you connect to have sysadmin privilege?




"Mike" <mikey@xxxxxxxxxxxxx> wrote in message news:O%23FHnRP7IHA.3672@xxxxxxxxxxxxxxxxxxxxxxx
ALL,

We are currently undergoing a SQL injection attack. While I have denied all access to system tables in the databases for the account in question, I was wondering if there is any risk in denying execute rights on all the system stored procedures in the database as well for this account (which is a sql account I created for our web applications to use)

We are currently using MSSQL Server 2000 in the windows environment

Thoughts?

Thank you in advance!

Mike


.

Relevant Pages

  • Re: Unable to write to user profile...
    ... I've given the account rights to manage profile as well. ... On the database level, could you provide more information on the rights i need to grant the account? ... Microsoft Online Community Support ...
    (microsoft.public.sharepoint.portalserver.development)
  • Re: Please! Doesnt anyone know a better way to do this?
    ... account, they need to automatically be directed to the page to enter data ... session variable on the Account page. ... I assume here that you're checking a database when the user attempts to ... When a new user attempts to login or clicks to register, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Cannot rebuild non-portal-content index
    ... > I added the content index account to the SQL database giving it rights ... create a log-in entry for the new SharePoint account for the SQL ... This is an entirely different task from giving the rights to ... read and write in a particular database. ...
    (microsoft.public.sharepoint.portalserver)
  • Re: Best way to parse file into db-type layout?
    ... That's an awful lot of columns to put into a database table, ... The rows are identified by Letter type and an account number (always the ... Off to search for dictionaries and databases now. ... > What you need is a clear appreciation of what you are trying to do ...
    (comp.lang.python)
  • Re: Help with WSS 3.0 Server Farm Config - Backend SQL 2005
    ... I had to use only "sharepoint" to get the ... What interest me though is that the database get created but fails after ... Virtual Server with DBSVR ... an account local to the WEBSVR) to create and access the SQL server, ...
    (microsoft.public.sharepoint.windowsservices)