Improving Web Application Security: Threats and - CGISecurity

How To: Secure Your Developer Workstation 773Apply Patches for Each Instance of SQL Server and MSDEMSDE shares common technology with SQL Server, and it enables developers,partners, and IT professionals to build database applications without requiring thefull SQL Server product. MSDE can be packaged with applications that requiredatabase support. To apply patches to MSDE, you must know which applicationinstalled it on your system. This is important because you must obtain the patch forMSDE from the product vendor.For more information on applications that include MSDE, refer to the followingresources:● “Microsoft Products That Include MSDE,” at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/MSDEapps.asp●“SQL Server/MSDE-Based Applications,” at http://www.sqlsecurity.com/forum/applicationslistgridall.aspxIf your third-party vendor does not supply a patch for MSDE, and if it becomescritical to have the latest patches, you can only do the following:● Uninstall the instance of SQL Server using Add/Remove Programs. If you do notsee an uninstall option for your instance, you might need to uninstall yourapplication.● Stop the instance of SQL Server using the Services MMC snap-in in ComputerManagement. You can also stop the instance from the command line by runningthe following command:●net stop mssqlserver (default instance), mssql$instancename (for instances)Use IPSec to limit which hosts can connect to the abandoned (unpatched)instances of SQL Server. Restrict access to localhost clients.Analyze SQL Server and MSDE Security ConfigurationUse MBSA to analyze your Microsoft SQL Server or MSDE configuration on yourworkstation. To analyze SQL Server and MSDE security configuration1. Run MBSA by double-clicking the desktop icon or selecting it from thePrograms menu.2. Click Scan a computer. MBSA defaults to the local computer.3. Clear all check boxes except for Check for SQL vulnerabilities.This option scans for security vulnerabilities in the configurations of SQL Server7.0, SQL Server 2000, and MSDE. For example, it checks the authentication mode,the sa account password, and the SQL Server service account, among other checks.A number of the checks require that your instance of SQL Server is running. If it isnot running, start it.