Solved

SQL Server 2000: Are the permisions for the public role important?

Posted on 2008-06-23
3
313 Views
Last Modified: 2010-04-21
Hi Experts,

in regards to the SQL Injection Hack the past weeks, we take a look on the permissions in our SQL Server and seen the permisions for the public role. There are many select or exec permissions given, mostly system tables and some standard SP.

We wonder if these permissions are important. We put them off and our Websites and other Apps seems still working. Are there some permissions we should let open?

Regards,
Christophe
0
Comment
Question by:meishu
3 Comments
 
LVL 60

Accepted Solution

by:
chapmandew earned 250 total points
ID: 21845293
Well...it depends.  These would be permissions given to every user in the db who can connect...so, it is likely reasonably important.  It becomes even more important if you're dealing with sensitive data or have given public permission to run xp_cmdshell.  If you've taken the perms away and all is still well, then keep it that way.  If you have taken them away and start getting problems, investigate the exact permissions needed and give them to an account other than public.
0
 
LVL 5

Expert Comment

by:kumar_jac
ID: 21845846
Hi,
 Regarding Sql Injection Attack,
If you do data manipilation only by SPs do this
Create a new user and Revoke permissions to all tables.
Only give the permission to SPs you want to execute.
If you have 2 set of SPs for user and Admin grant only access to User SPs

If the user have permission to execute the SP no need of permission to execute tables.
So If hacker use the table name also that won't affect.

If he pass some dynamic query to SP also that will fail

Thanks

Krishna
0
 

Author Closing Comment

by:meishu
ID: 31469699
Thx for the quick Answer. I was hopping to get more details, but I will handle it that way.
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Having an SQL database can be a big investment for a small company. Hardware, setup and of course, the price of software all add up to a big bill that some companies may not be able to absorb.  Luckily, there is a free version SQL Express, but does …
Introduction SQL Server Integration Services can read XML files, that’s known by every BI developer.  (If you didn’t, don’t worry, I’m aiming this article at newcomers as well.) But how far can you go?  When does the XML Source component become …
Familiarize people with the process of utilizing SQL Server functions from within Microsoft Access. Microsoft Access is a very powerful client/server development tool. One of the SQL Server objects that you can interact with from within Microsoft Ac…
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now