Test Kennung:	1.3.6.1.4.1.25623.1.0.10673
Kategorie:	Default Accounts
Titel:	Microsoft SQL (MSSQL) Server Blank Password (TCP/IP Listener)
Zusammenfassung:	The remote Microsoft SQL (MSSQL) Server has the default 'sa'; account enabled without any password defined.
Beschreibung:	Summary: The remote Microsoft SQL (MSSQL) Server has the default 'sa' account enabled without any password defined. Vulnerability Impact: An attacker can use these accounts to read and/or modify data on the Microsoft SQL Server. In addition, the attacker may be able to launch programs on the target operating system. Solution: Disable this account, or set a password to it. In addition to this, it is suggested you filter incoming TCP traffic to this port. For MSDE (OEM versions without MSQL console) : C:\MSSQL7\BINN\osql -U sa At the Password: prompt press . Type the following replacing .password. with the password you wish to assign, in single quotes: EXEC sp_password NULL, .password., .sa. go exit CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2000-1209 BugTraq ID: 4797 http://www.securityfocus.com/bid/4797 Bugtraq: 20000710 MSDE / Re: Default Password Database (Google Search) http://marc.info/?l=bugtraq&m=96333895000350&w=2 Bugtraq: 20000810 Tumbleweed Worldsecure (MMS) BLANK 'sa' account password (Google Search) http://marc.info/?l=bugtraq&m=96593218804850&w=2 Bugtraq: 20000815 MS-SQL 'sa' user exploit code (Google Search) http://security-archive.merton.ox.ac.uk/bugtraq-200008/0233.html Bugtraq: 20000816 Released Patch: Tumbleweed Worldsecure (MMS) BLANK 'sa' account password (Google Search) http://marc.info/?l=bugtraq&m=96644570412692&w=2 Bugtraq: 20020522 Opty-Way Enterprise includes MSDE with sa <blank> (Google Search) http://online.securityfocus.com/archive/1/273639 CERT/CC vulnerability note: VU#635463 http://www.kb.cert.org/vuls/id/635463 COMPAQ Service Security Patch: SSRT2195 ISS Security Advisory: 20020521 Microsoft SQL Spida Worm Propagation Microsoft Knowledge Base article: Q313418 http://support.microsoft.com/default.aspx?scid=kb;[LN];Q313418 Microsoft Knowledge Base article: Q321081 http://support.microsoft.com/default.aspx?scid=kb;EN-US;q321081 http://www.osvdb.org/3570 http://www.iss.net/security_center/static/1459.php
Copyright	Copyright (C) 2001 HD Moore

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.