[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

SQL Server 2000: Are the permisions for the public role important?

Posted on 2008-06-23
3
Medium Priority
?
363 Views
Last Modified: 2010-04-21
Hi Experts,

in regards to the SQL Injection Hack the past weeks, we take a look on the permissions in our SQL Server and seen the permisions for the public role. There are many select or exec permissions given, mostly system tables and some standard SP.

We wonder if these permissions are important. We put them off and our Websites and other Apps seems still working. Are there some permissions we should let open?

Regards,
Christophe
0
Comment
Question by:meishu
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 60

Accepted Solution

by:
chapmandew earned 750 total points
ID: 21845293
Well...it depends.  These would be permissions given to every user in the db who can connect...so, it is likely reasonably important.  It becomes even more important if you're dealing with sensitive data or have given public permission to run xp_cmdshell.  If you've taken the perms away and all is still well, then keep it that way.  If you have taken them away and start getting problems, investigate the exact permissions needed and give them to an account other than public.
0
 
LVL 5

Expert Comment

by:kumar_jac
ID: 21845846
Hi,
 Regarding Sql Injection Attack,
If you do data manipilation only by SPs do this
Create a new user and Revoke permissions to all tables.
Only give the permission to SPs you want to execute.
If you have 2 set of SPs for user and Admin grant only access to User SPs

If the user have permission to execute the SP no need of permission to execute tables.
So If hacker use the table name also that won't affect.

If he pass some dynamic query to SP also that will fail

Thanks

Krishna
0
 

Author Closing Comment

by:meishu
ID: 31469699
Thx for the quick Answer. I was hopping to get more details, but I will handle it that way.
0

Featured Post

Learn how to optimize MySQL for your business need

With the increasing importance of apps & networks in both business & personal interconnections, perfor. has become one of the key metrics of successful communication. This ebook is a hands-on business-case-driven guide to understanding MySQL query parameter tuning & database perf

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Ready to get certified? Check out some courses that help you prepare for third-party exams.
This month, Experts Exchange sat down with resident SQL expert, Jim Horn, for an in-depth look into the makings of a successful career in SQL.
Via a live example combined with referencing Books Online, show some of the information that can be extracted from the Catalog Views in SQL Server.
Viewers will learn how the fundamental information of how to create a table.

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question