Nessus
[Top] [All Lists]

no rating of finding ms-sql-s has account sa with password sa

To: Nessus@list.nessus.org
Subject: no rating of finding ms-sql-s has account sa with password sa
From: Oskar <os12345@xs4all.nl>
Date: Wed, 06 Jun 2007 09:31:41 +0200
Cc:
Delivered-to: sp-com-lists@consult.net
Delivered-to: nessus-list1@securepoint.com
Delivered-to: Nessus@list.nessus.org
List-archive: <http://mail.nessus.org/pipermail/nessus>
List-help: <mailto:nessus-request@list.nessus.org?subject=help>
List-id: Discussion of Nessus software <nessus.list.nessus.org>
List-post: <mailto:nessus@list.nessus.org>
List-subscribe: <http://mail.nessus.org/mailman/listinfo/nessus>, <mailto:nessus-request@list.nessus.org?subject=subscribe>
List-unsubscribe: <http://mail.nessus.org/mailman/listinfo/nessus>, <mailto:nessus-request@list.nessus.org?subject=unsubscribe>
Sender: nessus-bounces@list.nessus.org
User-agent: Thunderbird 1.5.0.12 (Windows/20070509)
I'm getting this finding:

|ms-sql-s (1433/tcp)|10862|Security Hole|The following accounts were found on the SQL Server:\nAccount 'sa' has password 'sa'\n\n\nAn attacker can use these accounts to read and/or modify\ndata on your SQL server. In addition, the attacker may be\nable to launch programs on the target Operating system\n\n

It has no rating, how come, as this particular finding allows me to take full control of everything on the SQL server with osql.exe.

Oskar



_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus

<Prev in Thread] Current Thread [Next in Thread>