Unable to drop an extended stored procedure in MS SQL 2005

Posted on 2009-02-11
Last Modified: 2012-05-06
I read about a security vulnerability with MS SQL and I wanted to ensure that I close it up. The vulnerability apparently relates to the extended stored procedure "sp_replwritetovarbin" and it is recommended that the procedure be deleted. No one here is using it for anything that I'm aware of, so I tried to do that with no success.

I first tried to do it from query analyzer by setting the current database to master and trying to execute:

DROP PROCEDURE sp_replwritetovarbin;

This does not work and gives me the error message:
Server: Msg 3701, Level 11, State 5, Line 1
Cannot drop the procedure 'sp_replwritetovarbin', because it does not exist or you do not have permission.

Next I tried:

EXEC dbo.sp_dropextendedproc 'sp_replwritetovarbin';

I get the same error message, however. So finally, I tried to do it through the SQL Management Studio on the database server. In the Object Explorer, I went to SERVER | Databases | System Databases | master | Programmability | Extended Stored Procedures | System Extended Stored Procedures. From this node, I right-clicked on sys.sp_replwritetovarbin and selected Delete. The "Delete Object" window appears, I click OK, and it gives me that same error message saying the procedure doesn't exist or I don't have permissions.

The problem I see with this is that I am doing all of this using the "sa" account, so I should be able to do anything right?
Question by:elorc
    LVL 75

    Expert Comment

    by:Anthony Perkins
    See here:
    Microsoft Security Advisory: Vulnerability in SQL Server could allow remote code execution

    Or just update SQL Server.
    LVL 75

    Accepted Solution

    All you have to do is deny EXECUTE permissions on it as in:
    DENY EXECUTE On sp_replwritetovarbin TO PUBLIC

    Or again simply fix it.
    LVL 1

    Author Comment

    Sweet. I'll review the link you provided. Thanks!

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    This is my first ever Article on EE or elsewhere; therefore, please bear with me if I have some discrepancies in my writing. I read many articles and questions related to "how to pass values to SSIS packages at run-time?"  Hence, this common ques…
    Performance is the key factor for any successful data integration project, knowing the type of transformation that you’re using is the first step on optimizing the SSIS flow performance, by utilizing the correct transformation or the design alternat…
    Via a live example, show how to extract information from SQL Server on Database, Connection and Server properties
    Via a live example, show how to backup a database, simulate a failure backup the tail of the database transaction log and perform the restore.

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now