Solved

All XP functions containing 'xp_reg' should be removed

Posted on 2013-01-24
3
1,812 Views
Last Modified: 2014-03-18
I ran a vulnerability scan on my Windows 2008 server with SQL 2005 server and need to fix this;

"SQL Insecure Registry Access Commands Detected
Deny access to all store procedures that allow users to read or write the system's registry.  All XP functions containing 'xp_reg' should be removed or restricted from access."

Any idea what I need to do to fix this?
0
Comment
Question by:355LT1
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 7

Accepted Solution

by:
Ross Turner earned 500 total points
ID: 38813456
You Could try this to find any instances of xp_reg:
use master
select o.name,user_name(p.grantee_principal_id)
from sys.system_objects o, sys.database_permissions p
where o.object_id = p.major_id and
o.name like ‘xp_reg%’ and p.type=’EX’

Open in new window

Revoke execute permissions to registry procedures where not authorized.
From the query prompt:
revoke execute on <registry procedure name> from <user name>

Open in new window

0
 

Author Comment

by:355LT1
ID: 38813727
I executed these 5 commands in sqlcmd and there now results from 1-5

anything missing
0
 

Expert Comment

by:tnrdhdhllblly
ID: 39937936
Thanks so much! This helped tremendously.
0

Featured Post

NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Long way back, we had to take help from third party tools in order to encrypt and decrypt data.  Gradually Microsoft understood the need for this feature and started to implement it by building functionality into SQL Server. Finally, with SQL 2008, …
In SQL Server, when rows are selected from a table, does it retrieve data in the order in which it is inserted?  Many believe this is the case. Let us try to examine for ourselves with an example. To get started, use the following script, wh…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question