MsSQL WebAdmin Permissions - serious

[ryanz]

Hi,

When we log into the MsSQL database using the WebAdmin (either ASP.NET or myLittleAdmin) we can see and access all databases on the SQL server. These include the System DB's and the User DB's.

The concern is that anyone can fiddle with the System DB's.

How do we correct this?

Plesk 9.0
Windows 2008 Server
MsSQL Server 2005

 

[Nilim]

Hi Ryan,

Here's a similar issue I have experienced few days ago. I restored a customer database backup on a shared MSSQL 2005 server which came with an active 'guest' user with dbo privileges. Outcome was, anyone on that shared server could view and access that database alongwith their's, via WebAdmin! Might pay to check if db 'guest' users are active.

 

[ryanz]

Yes, there is a guest user with connect permissions but I can't change this.
The error message is:

Revoke failed for Database 'master'. (Microsoft.SqlServer.Smo)

ADDITIONAL INFORMATION:

An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.ConnectionInfo)


So I removed that user but it was recreated when sql server restarted.
These are links I found:
http://www.mssqltips.com/tip.asp?tip=1172
http://msdn.microsoft.com/en-us/library/ms190928.aspx