Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I have another database Ydb accessing data in database Kdb. They both have the same owner.
In order to allow cross database chaining, it seems I need the guest user to be enabled in Kdb.

I did so like this:

USE [master];
GO
ALTER DATABASE Ydb SET DB_CHAINING ON;
ALTER DATABASE Kdb SET DB_CHAINING ON;
GO
USE [Kdb]
GO
GRANT CONNECT TO guest;

I realize this means stored procedures in Ydb created by Ydb's owner may freely access objects in Kdb when created by the same login. What kinds of attacks does this open up?

share|improve this question
add comment

1 Answer

It does not open up directly to an "attack". It just means that any user from Database 1 (Kdb) can also access database 2 (Ydb). What's usually more critical is, when you have users with DDL-Permissions (create views, procedures) - they will also be able to access objects in database2. Maybe even more, than plain guests can. That depends on the object owners and permissions you are planning to grant to guest(s).

Under SQL Server before 2012, there was one little security hole, described here: Security-issue: guest-guest impersonation, but this is a very limited scenario

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.