http://www.sqlsecurity.com SQL Server Security Website by Chip Andrews en-US Copyright 1999 by Chip Andrews chip@sqlsecurity.com Looks like another mass SQL Injection attack is making the rounds. The attackers likely used Google... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 25 Apr 2008 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=834 Applications that allow users to run code in an authenticated context (IIS, SQL Server) could be at ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sat, 19 Apr 2008 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=833 Kevin Beaver has highlighted some SQL Server 2008 features that may interest readers. Feel free to ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 19 Mar 2008 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=832 Microsoft has released the CTP for SQL Server 2008. On the security side, Microsoft is touting the ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 26 Feb 2008 08:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=831 I wanted to personally apologize for the delay in Discussion Forum moderations. Usually I stay on t... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 03 Feb 2008 08:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=830 Apparently a new worm has appeared on the Internet that uses SQL injection to infect sites with mali... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 08 Jan 2008 08:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=829 While the overall effectiveness of penetration testing as a security mechanism is debatable, it sure... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 26 Dec 2007 08:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=828 I have added a page to the site to host security tools I have created for security engagements and/o... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 04 Nov 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=827 I have finally posted an alpha release of the command-line version of SQLPing3. Please provide any f... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 24 Oct 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=826 One of the developers of the Paros Proxy (an excellent tool for scanning for SQL injection and XSS v... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 16 Oct 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=825 I hate to post announcements concerning internal administrative issues but for those concerned the v... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 29 Aug 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=824 Well, apparently there has been some budget cutting at the UN and developer training must have been ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 12 Aug 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=821 OK - so I wasn't able to make it to Las Vegas for Black Hat and DEFCON this year. That bites. But ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 06 Aug 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=820 Here is an excellent dissection of a typical SQL Injection attack with detailed descriptions and scr... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 17 Jul 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=819 Just when you were getting used to SQL Server 2005, Microsoft gives a glimpse a the next release. F... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 12 Jun 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=818 Acunetix has posted an article of web services security that discusses (at a high level) some of the... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 13 May 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=817 Hey - I'm always a fan of free so check it out (from their press release): "Scuba by Imperva is a f... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 06 May 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=816 SQLPing 3.0 is the evolution of the SQLPing product to the .NET Framework using code from SQLRecon. ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 22 Apr 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=814 I have re-compiled SQLRecon 1.0 with .NET Framework 2.0 for those of you who have been keeping up. ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 27 Mar 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=812 SQLSecurity.com is currently in the middle of a software upgrade. I will re-post the older blog ent... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 20 Mar 2007 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=625 Acunetix has posted an excellent series of articles on web application security including several on... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 13 Feb 2007 02:18:57 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=660 It appears Microsoft has finally presented an explanation and workaround for those wishing to run SQ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 30 Jan 2007 19:48:29 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=659 For those of you planning to jump on Windows Vista for all those supposed new security improvements ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sat, 16 Dec 2006 19:49:23 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=658 Amit Basu has submitted an excellent article on implementing forensic tamper detection in SQL Server... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 07 Nov 2006 18:14:10 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=657 Tim Mullen has started a new open-membership security organization with a provocative name. The orga... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 23 Oct 2006 23:55:45 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=656 For anyone who has ever assembled a SQL Server connection string, the phrase "Integrated Security=SS... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 10 Sep 2006 12:57:21 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=655 ISC has concluded that the spike in TCP 1433 is probably due to someone using the old MSSQL 2000 pre... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 21 Jul 2006 16:04:58 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=654 ISC is reporting a spike in TCP 1433 (default SQL Server posrt) scans across the internet as detecte... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 19 Jul 2006 11:42:16 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=653 I've been adding plenty of products to the Assessment Tools section of the site under "SQL Server Re... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 09 Jul 2006 23:21:26 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=652 You've been there. You're on some site, tooling around looking at news, articles, whatever. Sudden... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 11 May 2006 19:12:31 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=651 SQL Server 2005 Service Pack 1 has been released. One noticable difference right off the top is tha... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 23 Apr 2006 17:03:15 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=650 In a Computerworld article on SQL Server 2005 SP1, I was asked to provide some commentary. Since I'... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 17 Mar 2006 02:29:47 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=649 Well - that was fast - the tools are back online and the free analysis page is working again. Pleas... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 02 Mar 2006 04:50:21 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=648 In case you haven't noticed, I have upgraded the site to DNN 4.0.2 and am in the process on integrat... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 01 Mar 2006 03:29:19 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=647 This is an excellent TechTarget article on SQL Server security testing by Kevin Beaver. The highligh... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 01 Mar 2006 01:45:30 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=645 Informative article on how attackers commonly compromise SQL Server systems. Besides the scenarios, ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 01 Mar 2006 01:44:12 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=646 Now that we have a release for SQL 2005 in our grubby little hands, its time for some good ole pen t... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 16 Dec 2005 00:56:08 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=795 SQL Server 2005 and Visual Studio 2005 Professionsal have been released to manufacturing. You shoul... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 28 Oct 2005 15:49:55 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=794 Not sure how I forgot to post this earlier but I did record a webcast series on SearchSQLServer.com ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 07 Oct 2005 21:12:52 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=793 OK - it's been kinda quiet lately on the SQL Server front that's for sure. But look on the bright s... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 30 Sep 2005 23:20:16 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=792 OK - so I had every intention of going to Black Hat this week. I was packed. I had my new laptop r... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sat, 30 Jul 2005 00:45:22 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=791 I will be one of many trainers for a course on web application security at Black Hat in Vegas July 2... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 10 Jul 2005 19:08:13 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=790 At Teched Orlando, Paul Flessner announced that Nov 7, 2005 is the release date for SQL Server 2005 ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 09 Jun 2005 01:49:24 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=789 Microsoft's WSUS product has been released to manufacturing and was distributed attendees at Teched.... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 09 Jun 2005 01:44:30 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=788 In case you haven't heard by now SP4 for SQL Server 2000 has finally been released. This release in... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 10 May 2005 01:10:37 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=787 Article by Don Kiely on the new security features of SQL Server 2005 and what it means for you. Sub... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sat, 07 May 2005 03:31:14 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=786 Idera's SQL compliance manager provides a powerful auditing and compliance solution for Microsoft SQ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 22 Apr 2005 18:04:06 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=785 Are you ready to experience SQL Server 2005? Announcing the launch of the SQL Server 2005 Virtua... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 07 Apr 2005 14:38:41 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=784 Microsoft has released a special version of MSDE to be released with Windows Sharepoint Server and r... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 28 Mar 2005 17:48:30 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=781 Microsoft has announced the release candidate open evaluation for the successor to Windows Update Se... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 28 Mar 2005 17:41:02 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=783 I just finished a two-part series on finding and patching SQL Servers in your organization for TechT... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 28 Mar 2005 17:02:07 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=782 SQLRecon v1.0 has been released to the public as a free tool. SQLRecon performs both active and pas... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 22 Mar 2005 18:53:16 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=779 In case you haven't figured it out by now, I've joined forces with some of my favorite IT security ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 22 Mar 2005 16:49:36 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=780 DTSConnPass - utility to decrypt DTS package Connection passwords. If you export a DTS package as ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 02 Mar 2005 01:09:26 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=778 This debate occurred on TheServerSide.NET and the original poster was way off on this topic but the ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 24 Feb 2005 05:54:33 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=777 In association with Special Ops Security, I will soon be releasing a tool called SQLRecon to the gen... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 09 Feb 2005 19:02:33 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=776 According to ISC SANS, there have been a large number of SQL Server authentication brute force attem... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 31 Dec 2004 12:14:14 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=775 Want a glimpse at some of the new security features in SQL Server 2005? Check out this webcast - it... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 09 Dec 2004 17:59:15 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=774 The FxCop tool from Microsoft, which scans .NET assemblies for various development flaws, has added ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 04 Nov 2004 20:44:24 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=773 I've started a new project concerning the construction of a custom administrative template for Group... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 26 Oct 2004 18:20:05 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=772 Why is this relevant to SQL Server you ask? Well, in his discussion of Windows Design he uses the S... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 22 Oct 2004 18:33:08 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=771 Despite the fact that most visitors think SQL Server security is improving (according to a recent no... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 11 Oct 2004 23:44:35 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=770 Microsoft is hosting a free webcast on resolving issues related to running SQL Server 2000 on XP SP2... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 04 Oct 2004 15:00:54 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=769 While I have seen no verification from Microsoft of this and have not tested it myself, a denial of ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 30 Sep 2004 20:49:22 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=768 Let's face it - It's been real quiet in the world of SQL Server security as of late. Not a lot of n... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 17 Sep 2004 14:55:50 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=767 According to MSDN, SQL Server 2005 Express Edition will replace MSDE as the free offering to get peo... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 30 Jun 2004 11:55:02 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=765 Tool to inspect a SQL Server installation and compare its configurating against Microsoft's security... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 25 Jun 2004 14:14:01 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=764 Microsoft is warning you ahead of time of some changes that will take place in Windows XP Service Pa... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 23 Jun 2004 17:54:07 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=763 There's a link on the Slashdot blog to an article with the details. Plenty of humorous commentary o... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 01 Jun 2004 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=762 There is a disturbing report from SANS about some increased SQL Server scanning activity from what m... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 01 Jun 2004 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=766 Some excellent technical analyses of how attacks might circumvent SQL Injection Signatures. The con... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 28 Apr 2004 15:37:35 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=761 Looks like past flaws in SQL Server are part of a new variant of an existing worm now propogating. ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 26 Apr 2004 04:06:06 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=760 For anyone who's looking for an article on the subject of SQL Injection targeted at the layman, Jere... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 06 Apr 2004 00:49:56 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=759 Microsoft is releasing a beta of a tool very similar to the Microsoft Baseline Security Analyzer tar... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 22 Mar 2004 14:07:19 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=758 Here is an excellent article on SecurityFoucs.com on detecting SQL-Injection and Cross-Site scriptin... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 18 Mar 2004 12:20:39 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=757 OK - this one's for those that want to get the version of a SQL Server instance withuot logging into... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 27 Feb 2004 13:44:35 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=756 I've added a new tab for the SQL Server version database. I'm especially glad to see this since it ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sat, 31 Jan 2004 03:37:56 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=755 Had a great time last week at Black Hat in Vegas - it was great to meet some of you out there face t... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sat, 24 Jan 2004 22:13:38 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=745 While I have yet to see the first instance of a SQL Server service pack or hotfix in Windows Update ... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 22 Jan 2004 21:41:47 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=754 I want apologize in advance for any interruptions in service anyone may have endured as SQLSecurity.... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 20 Jan 2004 13:04:59 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=753 New MDAC Vulnerability is a reverse spin on MS02-039 whereby a response to a discovery packet sent b... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 14 Jan 2004 06:44:38 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=752 In an effort to update the user interface and streamline future updates, I've ported the SQLSecurity... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 29 Dec 2003 06:12:28 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=751 This chapter 12 , by Chip Andrews (me), is excerpted from Erik Birkholz's recently published "Spe... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 25 Dec 2003 02:01:05 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=735 The new SQL Server Security book (Osborne/McGraw-Hill) is on the shelves now. The book is collabora... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 25 Dec 2003 01:55:28 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=749 I know - I know. This is the longest quiet streak in SQLSecurity.com history for SQL Server securit... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 08 Dec 2003 23:03:28 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=750 Since we're all SQL Server buffs here - the MDAC is obviously something we all have an interest in s... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 21 Aug 2003 05:44:25 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=748 For any of you that have spent the better part of today patching machines that STILL haven't got the... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 13 Aug 2003 01:18:45 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=747 For any of those that have been waiting for an entire book devoted to SQL Server security called (od... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 05 Aug 2003 16:35:48 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=746 Three-for-one day at @stake (www.atstake.com)! The hijack and denial of service vulnerabilities aff... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 24 Jul 2003 01:42:32 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=744 Cesar Cerrudo is reporting a buffer overflow in the Microsoft Access Jet 4.0 drivers which can be in... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 11 Jul 2003 21:54:29 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=743 While not limited to SQL Server, this vulnerability is especially dangerous to SQL Server as it allo... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 08 Jul 2003 20:47:32 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=742 Microsoft has beefed up Service Pack 3a with a new feature - the ability to disable the UDP 1434 lis... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Tue, 27 May 2003 14:22:22 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=741 These new whitepapers, made available on Technet, give Microsoft's thoughts and recommendations on t... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 18 May 2003 15:38:06 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=740 Some excellent resources from the guys at Application Security Inc. (www.appsecinc.com) during Blac... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 02 May 2003 02:45:12 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=739 Thanks to Willis Johnson for these links: http://msdn.microsoft.com/netframework/downloads/updates/s... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 17 Apr 2003 07:00:00 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=738 If you've installed Visual Studio.NET or the .NET SDK and you want to upgrade the MSDE installed wit... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 31 Mar 2003 21:59:24 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=737 Microsoft has packaged a toolkit, of sorts, of various programs used to determine if you are vulnera... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Fri, 07 Mar 2003 18:56:26 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=736 I really appreciate all who have contributed and continue to contribute to the list of SQL Server/MS... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 30 Jan 2003 18:27:31 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=734 I have updated the applications list section of the site so it now accepts submissions for SQL Serve... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Thu, 30 Jan 2003 18:02:26 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=733 The worm we always knew was coming has arrived. It targets the UDP 1434 lister for the SQL Server R... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Sun, 26 Jan 2003 06:08:23 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=732 Time to get patching again with Microsoft's latest Service Pack for SQL Server 2000. Keep in mind a... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Mon, 20 Jan 2003 19:41:41 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=731 After receiving a few requests for a .NET version of SQLPing I coded one up last night. I've only g... http://www.sqlsecurity.com/Home/tabid/36/Default.aspx Chip Andrews Wed, 01 Jan 2003 02:18:23 GMT http://www.sqlsecurity.com/Home/tabid/36/Default.aspx?ItemId=730