Data Driver

Blog archive

Is SQL Password Vulnerability A Real Threat?

Earlier this month, Sentrigo, Inc, issued a warning pointing to a vulnerability in Microsoft's SQL Server database where unencrypted passwords could be accessed by unauthorized individuals. The way the vendor put it, someone could retrieve the passwords by reviewing the contents of SQL Server process memory using widely available tools.

Sentrigo described this as a serious issue -- so serious that it is offering a free tool to remedy the situation. That same day, Microsoft posted a bulletin saying it is not classifying the issue as a vulnerability.

"We checked with the security researchers who reported the issue and they confirmed that this is an information disclosure issue requiring the attacker to first have administrative control of the installation," according to its posting. "Therefore, we do not consider this a bulletin class vulnerability."

But the folks at Sentrigo argue Microsoft is missing the point. In a FAQ posted on its Web site, the company acknowledged that the perpetrator must have administrative privileges for the vulnerability to be a threat. But in most organizations, the vendor argued, more than one individual has administrative access. Also as many apps are run with administrative privileges, SQL injections could also reveal passwords. By running its tools, the first and last characters of passwords are erased.

Gary McGraw, chief technology of consulting firm Cigital that specializes in software security, told me the best solution is simply not to give out administrative privileges.

"Of course administrators can do evil things. That's why you shouldn't allow everyone to be an administrator," McGraw said. "A lot of people to this day tend to run all sorts of things, including database engines, Web servers, and programs, as an administrator, or as root, and that's an extremely bad idea. The good news is modern versions of Windows and modern versions of other operating systems are making it easier to run programs with much less privileges."

Still some bloggers argue Microsoft is sweeping the issue under the rug. Do you think Microsoft needs to take a more proactive stance here or do organizations need to take a look at how they assign administrative rights to those who run SQL Server and related applications?

Feel free to comment, or drop me a line at [email protected].

Posted by Jeffrey Schwartz on 09/17/2009


comments powered by Disqus

Featured

  • Hands On: New VS Code Insiders Build Creates Web Page from Image in Seconds

    New Vision support with GitHub Copilot in the latest Visual Studio Code Insiders build takes a user-supplied mockup image and creates a web page from it in seconds, handling all the HTML and CSS.

  • Naive Bayes Regression Using C#

    Dr. James McCaffrey from Microsoft Research presents a complete end-to-end demonstration of the naive Bayes regression technique, where the goal is to predict a single numeric value. Compared to other machine learning regression techniques, naive Bayes regression is usually less accurate, but is simple, easy to implement and customize, works on both large and small datasets, is highly interpretable, and doesn't require tuning any hyperparameters.

  • VS Code Copilot Previews New GPT-4o AI Code Completion Model

    The 4o upgrade includes additional training on more than 275,000 high-quality public repositories in over 30 popular programming languages, said Microsoft-owned GitHub, which created the original "AI pair programmer" years ago.

  • Microsoft's Rust Embrace Continues with Azure SDK Beta

    "Rust's strong type system and ownership model help prevent common programming errors such as null pointer dereferencing and buffer overflows, leading to more secure and stable code."

  • Xcode IDE from Microsoft Archrival Apple Gets Copilot AI

    Just after expanding the reach of its Copilot AI coding assistant to the open-source Eclipse IDE, Microsoft showcased how it's going even further, providing details about a preview version for the Xcode IDE from archrival Apple.

Subscribe on YouTube

Upcoming Training Events