2

I'm trying to disable xp_Cmdshell and rpc_out and when I run the commands on query analyzer it shows it's disabled.

But after this I need to run a security scan report which provides me the following report that it's has not been disabled. Can anyone help me?

5 Microsoft SQL Server Database Link Crawling Command Execution

QID:
19824

Category:
Database

CVE ID:
-

Vendor Reference
-

Bugtraq ID:
-

Service Modified:
02/20/2013

User Modified:
-

Edited:
No

PCI Vuln:
Yes

THREAT:
Microsoft SQL Server is exposed to a remote command execution vulnerability.

Affected Versions:
Microsoft SQL Server 2005, 2008, 2008 R2, 2012 are affected.

IMPACT:
Successful exploitation could allow attackers to obtain sensitive information and execute arbitrary code.

SOLUTION:
There are no solutions available at this time.
Workaround:
Disable RPC_Out and xp_cmdshell for this issue.

COMPLIANCE:
Not Applicable

EXPLOITABILITY:
There is no exploitability information for this vulnerability.

ASSOCIATED MALWARE:
There is no malware information for this vulnerability.

RESULTS:
C:\Program Files\Microsoft SQL Server\MSSQL10_50.SQLEXPRESS\MSSQL\Binn\sqlservr.exe Version is 2009.100.4000.0

1
  • You have to run RECONFIGURE when you disable those configuration options. – Kin Shah Apr 18 '13 at 19:57
2

You can see the actual value with the following tiny script:

SELECT * 
FROM sys.configurations
where name='xp_cmdshell'

You can also do it this way to see all advanced options:

EXEC sp_configure 'Show Advanced Options', 1;
GO
RECONFIGURE;
GO
EXEC sp_configure;
1

Your security scanning software is likely identifying your system running sql server and highlighting this as a risk. There is no actual validation of a risk through code, just flagging it as a possibility due to the presence of the SQL Server executables.

I have this same 'vulnerability' on my system while having xp_cmdshell disabled and no linked servers presents. Linked servers would have the option of 'RPC_OUT'. You can review your settings and then mark the issue as resolved/closed in your tracking system as there is nothing to do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.