557 : MS-SQL Passwordless Admin Account
Printer | http://osvdb.org/557 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
22	1455	over 9 years ago	over 4 years ago	0 times	45%

This Entry needs help! It is only 45% Complete. Click the edit link above to add more information.

Contributing is fast and easy, and benefits the entire security community.

Timeline

Disclosure Date
2000-05-30

Keywords

aka the "SQL Server 7.0 Service Pack Password" vulnerability

Description

Microsoft SQL Server versions 7 and 2000, along with Microsoft Data Engine (MSDE), by default installs an admin account ('sa') with a blank or null password. Using this account, it is possible for an intruder to modify and delete information stored in the database and may be able to run commands at the operating system level through the xp_cmdshell stored procedure.

Classification

Unknown or Incomplete

Technical

The default installation of MSSQL, using Standard or Mixed Mode security, has a default admin account of 'sa' with no password. This vulnerability allows the ability to retrieve information stored in the database, or delete data from the database. An attacker also may be able to exploit this priviledged account to execute commands on this host by calling the 'xp_cmdshell' extended stored procedure. This stored procedure provides a wrapper for 'cmd.exe'.

Solution

Change the password for the 'sa' account, or switch to Domain Authentication mode for this server. To change the 'sa' account password on an MSSQL 7.0 Server, perform the following steps (these steps should be fairly similar on different versions of MSSQL Server): 1. Click Start -> Programs -> Microsoft SQL Server -> Enterprise Manager 2. Expand 'Console Root' (click on the plus (+) symbol to the left of 'Console Root'). 3. Expand 'Microsoft SQL Servers'. 4. Expand 'SQL Server Group'. 5. Double click the name of the affected SQL server. 6. Double click 'Security'. 7. In the right-hand pane, double click on 'Logins'. 8. Right click on 'sa' and select 'Properties'. 9. Click the 'General' tab. 10. Under 'SQL Server Authentication', enter your password of choice and click 'OK'. 11. Enter password again in the 'Confirm Password' popup window. 12. Exit Enterprise Manager.

Products

Unknown or Incomplete

References

Bugtraq ID: 1281
CVE ID: 2000-0402 (see also: NVD)
Microsoft Knowledge Base Article: 263968
ISS X-Force ID: 3949 4584
Keyword: aka the "SQL Server 7.0 Service Pack Password" vulnerability
Generic Informational URL: http://www.sqlsecurity.com/DesktopDefault.aspx?tabindex=3&tabid=4
Microsoft Security Bulletin: MS00-035

Tools & Filters

	11330

Credit

Unknown or Incomplete

CVSSv2 Score

CVSSv2 Base Score = 2.1
Source: nvd.nist.gov | Generated: 2003-12-31 | Disagree?

Blogs

This product uses the Daylife API but is not endorsed or certified by Daylife.

This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.

None found at this time

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.