Re: [SPAM] Re: [Full-Disclosure] Spybot and SQL

[Jacek Barcikowski <m.esco@xxxxx>]

Matthew Farrenkopf wrote:

> (The MSDE engine was installed on two machines for an application we
> use, and the engine is used only locally by the application.  The
> thought never crossed my mind that the engine was misconfigured with a
> blank sa password, but on analysis it looks like that's how the
> application communicates with the database.  There's no option to add a
> password in the application, so I blocked port 1433 to the outside
> world.  Problem solved until we can talk to the vendor.)

<off_topic>
Before the installation you can set up a setup.ini file with 
DISABLENETWORKPROTOCOLS=1 configuration option in it. MSDE will not 
listen to any port, therefore cannot be accessed from the net.
</off_topic>

Best reagards,
m.esco

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html