Nessus Plugin #10673

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Microsoft's SQL Blank Password

Family:

Windows

Category:

attack

Copyright:

This script is Copyright (C) 2001 H D Moore

Summary:

Microsoft's SQL Blank Password

Version:

$Revision: 1.19 $

Cve_id:

CAN-2000-1209

Bugtraq_id:

1281, 4797

Xrefs:

-

Description:

The remote MS SQL server has the default 'sa' account
enabled without any password.

An attacker may use this flaw to execute commands against
the remote host, as well as read your database content.

Solution : disable this account, or set a password to it. In addition
to this, it is suggested you filter incoming tcp traffic to this port.

For MSDE (OEM versions without MSQL console) :

C:\MSSQL7\BINN\osql -U sa

At the Password: prompt press <Enter>.

Type the following replacing .password. with the password you wish to
assign, in single quotes:

EXEC sp_password NULL, .password., .sa.
go
exit


Risk factor : High