Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My hosting provider allows access to its SQL Server. When I connected to it by SQL Management Studio, all hosted databases were visible.

enter image description here

I can't get the details on these databases, I get this error:

"The database x is not accessible.(Object Explorer)

I don't know if there is a way to get sensitive information. Should I be worried about the security of my database? How should a company provide secure access to a database?

share|improve this question
    
I wonder if SQL Manager uses binary RPC, or Transact SQL to manage the servers.. –  makerofthings7 Oct 27 '13 at 13:43
    
Have you tried opening one of these DBs? Or did you just immediately post this to the internet without investigation? –  Rook Oct 27 '13 at 18:55
add comment

1 Answer

It is possible to have the rights to list the databases and not have the rights to use the database. The only way to know for sure would be to try and access one of these databases.

That being said, an attacker could use a privilege escalation vulnerability in MS-SQL to gain admin rights and then can access any DB. But this is a known problem with shared hosting and this is one of the reasons why it is less secure.

share|improve this answer
5  
Indeed, shared hosting is like living in an apartment building - you are at the mercy of your neighbours. If you want security, you can get your own private server and turn it into a castle surrounded by a ditch full of lava. –  Matrix Oct 28 '13 at 7:12
    
@Matrix Oah, wait, your datacenter doesn't have a lava-mote? That is a high risk vulnerability. –  Rook Oct 28 '13 at 17:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.