NetProwler 3.5.1 Security Update 17

June 10, 2002
NetProwler 3.5.1 Security Update 17

Description

NetProwler 3.5.1 SU17 introduces four (4) signatures. New signatures include the detection of the SQLSnake propagating across the network via the SQL port. Included also, are some unsafe practices of SQL. You may obtain NetProwler 3.5.1 SU 17 through the product's autoupdate feature.

Security Update 17 Signatures

SQL_NULL_Password

This signature detects the attempt to login to a Microsoft SQL Server as the SQL administrator using a blank password. It also detects the attempt of the SQLSnake to propagate, because the SQLSnake uses the blank 'sa' password to login to the SQL server.

http://securityresponse.symantec.com/avcenter/venc/data/digispid.b.worm.html

SQL_Guest_Account_Active

This signature detects a remote attempt to activate or deactivate the guest account. If the guest account is active, it allows anyone with a valid SQL Server login to access the databases that the guest account is a member. The guest account, by default, is added to the master database and to the pubs database when the system is installed.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/sql/maintain/security/default.asp

SQL_Guest_Local_Admin_Group

This signature detects someone attempting to add or remove the guest account to/from the local administrator's group. Adding the guest account to the local administrator's group would give guest all of the permissions that the local administrator's group has on the server.

http://www.microsoft.com/technet/prodtechnol/sql/proddocs/admincmp/75517c07.asp

SQL_Guest_Domain_Admin_Group

This signature detects someone attempting to add or delete the guest account to/from the domain administrator's group. Adding the guest account to the domain administrator's group would give the guest all of the permissions that the domain administrator's group has on the domain.

http://www.microsoft.com/technet/prodtechnol/sql/reskit/sql7res/part10/sqc15.asp

Last modified on: Monday, 10-Jun-02 20:33:56