July 30, 2010     |
Network Toaster
SQL Security Forums
Note: SQLSecurity.com does not allow nor require registration due to privacy concerns for users. SQLSecurity.com is open and anonymous for all. Please report any abuse or profanity.
Subject: SHOWPLAN permission in SQL 2005
Prev Next

Author Messages
John (guest)

06/08/2009 6:38 AM Quote Reply Alert 
Quoting from SQL Server 2008 Books Online - Users who have SHOWPLAN permission can view queries that are captured in Showplan output. These queries may contain sensitive information such as passwords.

Which passwords are they referring to?

Can it be a password from the owner of a SQL agent job that is using the sa account?

Thanks in advance.
Chip Andrews
Posts:113

06/10/2009 5:58 PM Quote Reply Alert 
They are referring to input that may be placed in queries or passed to stored procedures. Of course - passwords are just an example. Other data could be social security numbers, account numbers, physical addresses, names, anything!

Chip

Forums > Discussions > SQL Server Security > SHOWPLAN permission in SQL 2005

Quick Reply
Username:  
Subject:  
Body:
 



ActiveForums 3.6
Copyright 1999 by Chip Andrews   |  Privacy Statement  |  Terms Of Use