SQL Server security issues

Microsoft Security Bulletin http://www.microsoft.com/technet/security/bulletin/ms09-004.mspx issued in February 2009 is not an issue if you have SQL Server 2005 SP3 installed. If this is problematic to be installed, due to the fact that rollback requires the uninstall and reinstall of SQL Server, a fix to the vulnerability is

USE master
GO
DENY EXECUTE ON sys.sp_replwritetovarbin TO public
GO
NOTE: don’t use this with Transactional Replication with Updateable Subscriptions

The other fairly recent security issue from July 2008 is
http://www.microsoft.com/technet/security/bulletin/ms08-040.mspx

Types of patches

Quick-Fix Engineering (QFE)

The QFE is a Microsoft term for the delivery of individual service updates to its operating systems and application programs. Formerly called a hotfix, QFE can be used to describe both the method of delivering and applying a patch or fix, and also to refer to any individual fix.

General Distribution (GDR)

A GDR is typically associated with a critical patch release the product groups feels should be provided to and installed by the whole customer base. GDRs are often associated with security releases, or other critical fixes needed to mitigate a problem the majority of customers will experience when using our product.

Cumulative update package (CU)

Multiple cummulative updates are released between Service Packs and contains all of the applicable hot fixes at the time.

Service Packs (SP)

When there are a large enough collection of changes they are gathered together to be released as a service pack. A service pack can also deliver new product features.

Upgrading Sitecore databases

After upgrading existing Sitecore database the SQL Server internal stats need to be upgraded so that it is possible to query the internal tables and see the health of the sql server databases. If this is not done you receive false information and can miss the problems. Run

DBCC UPDATEUSAGE ('databasename')

Sitecore 6 Core Databases

The new version of Sitecore has significantly less databases than in previous versions. Previous versions had 7 now there are only 3. The Core, Master and Web Databases are the only databases in the latest version of Sitecore.

scMaster

Master stores all versions of content

scCore

Core stores all Sitecore settings for editors

scWeb

Web store published version of content

The “Sitecore” and “Extranet” security databases were removed as they are now handled by the .NET security model and stored in standard tables.

The “Archive” and “Recycle bin” databases were removed as each database now has its own internal archive and recycle bin storage areas. The archive and recycle bin have also been enhanced to contain a search facility similar to the content editor.

Sitecore 5 Default Database

Belows lists the default databases

scArchive

Contains archived objects. Sitecore can be configured to automatically remove objects from the Master database to the Archive database on a specific date. This removes old objects from the Master database but backs up a copy of the object. You can specify the archive date in the Content Editor » Tasks » Archive Date field.

scCore

Contains the Sitecore client.

scExtranet

Contains the extranet security settings.

scMaster

Contains the site under development.

scRecycleBin

Contains deleted objects. Items can be restored via the Sitecore » Administrator Tools » Recycle Bin application

scSecurity

Contains the client security settings.

scWeb

Contains the published web site.

SQL Injection

SQL Injection is a common vulnerability which can lead to the database being disabled, the web site displaying malicious contnet or even the the database can be destroyed. . Attacks come primarily through Web applications that allow an attacker to execute their own SQL commands on the application database. The defense against SQL-injection attacks must be code-based.

Protecting your code

A few simple steps you can take to protect your Web applications from SQL-injection attacks.

-Principle of Least Privilege
The account an application uses to connect to the database should have only the privileges that application requires.

-Validate All Input
Make the input is what you expect it to be.

-Avoid Dynamic SQL
Dynamic SQL is a great tool for performing adhoc queries, but combining dynamic SQL with user input creates exposure. You should replace dynamic SQL with prepared SQL or stored procedures .

-Use Double Quotes
Replace all the single quotes that your users' input contains with double quotes. Single quotes often terminate SQL expressions and give the input more power than is necessary.


Tools to help prevent and identify SQL Injection

Ensure the SQL Server is fully patched to include all security vulnerabilities

HP Scrawlr

Scrawlr, developed by the HP Web Security Research Group in coordination with the MSRC, is short for SQL Injector and Crawler. Scrawlr will crawl a website while simultaneously analyzing the parameters of each individual web page for SQL Injection vulnerabilities. Scrawlr is lightning fast and uses our intelligent engine technology to dynamically craft SQL Injection attacks on the fly.
Download here
https://h30406.www3.hp.com/campaigns/2008/wwcampaign/1-57C4K/index.php?mcc=DNXA&jumpid=in_r11374_us/en/large/tsg/w1_0908_scrawlr_redirect/mcc_DNXA

urlscan
UrlScan version 3.0 Beta is a Microsoft security tool that restricts the types of HTTP requests that Internet Information Services (IIS) will process.
Download here
http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1697


Microsoft Source Code Analyzer for SQL Injection tool
The tool is a static code analysis tool that helps you find SQL injection vulnerabilities in Active Server Pages (ASP) code.
Download here
http://www.microsoft.com/downloads/details.aspx?FamilyId=58A7C46E-A599-4FCB-9AB4-A4334146B6BA&displaylang=en

SQLInjectionFinder
SQLInjectionFinder (v1.5.0) Tool to help determine .asp pages targeted by recent SQL Injection attacks
Download here
http://www.codeplex.com/Release/ProjectReleases.aspx?ProjectName=WSUS&ReleaseId=13436

Policy Based Management

Terminology

Facet - Defines a management area within the policy based framework for a predefined set of properties
Condition - contains a single condition that you want to enforce that evaluates to True or False; i.e. the state of a Facet
Policy - defines the permitted stated for properties of a single facet and is a set of conditions specified on the facets of a target.
Target - an entity that is managed by Policy-Based management; e.g. a database, a table, an index, etc.

Order creation

Select a facet that contains properties you want to configure
Define a condition that specifies the permitted states of the facet
Define a policy that contains the conditions and sets one of the evaltion modes

Policy evaluation modes

• On demand - The policy is evaluated only when directly ran by the administrator.
• On change: prevent - DDL triggers are used to prevent policy violations.
• On change: log only - Event notifications are used to check a policy when a change is made.
• On schedule - A SQL Agent job is used to periodically check policies for violations.