Results 1 to 8 of 8

Thread: ODBC Backdoor into Sql 7.0?

  1. 05-09-2003, 10:30 AM #1
    Katyan
    Katyan is offline Registered User
    Join Date
    Oct 2002
    Location
    Trinidad
    Posts
    52

    ODBC Backdoor into Sql 7.0?

    Hi, I'm running SQL Server 7.0 I have a number of databases and specific users have been given access to different databases. I have recently realised that it is possible for a user not given access to say DATABASE1 to create an ODBC Data source to that Database to use MS Access to access the tables. I am using NT security via SQL.
    How can I stop this?
    Reply With Quote Reply With Quote
  2. 05-09-2003, 11:03 AM #2
    rmiao
    rmiao is offline Registered User
    Join Date
    Sep 2002
    Posts
    5,938
    How did they connect with odbc? Sql authentication or via trusted connection?
    Reply With Quote Reply With Quote
  3. 05-09-2003, 11:08 AM #3
    Katyan
    Katyan is offline Registered User
    Join Date
    Oct 2002
    Location
    Trinidad
    Posts
    52

    Trusted Connection

    The ODBC configuration used Trusted Connection.
    Reply With Quote Reply With Quote
  4. 05-09-2003, 11:42 AM #4
    rmiao
    rmiao is offline Registered User
    Join Date
    Sep 2002
    Posts
    5,938
    Then it depends on account used to log into windows. Double check its permission and permission of groups it belongs to on sql.
    Reply With Quote Reply With Quote
  5. 05-09-2003, 12:41 PM #5
    Katyan
    Katyan is offline Registered User
    Join Date
    Oct 2002
    Location
    Trinidad
    Posts
    52
    I have been able to veiw tables in the database, logged on as a users that does not have an account in SQL. No user name, no database permissions. So what's happening.
    Reply With Quote Reply With Quote
  6. 05-09-2003, 12:55 PM #6
    Katyan
    Katyan is offline Registered User
    Join Date
    Oct 2002
    Location
    Trinidad
    Posts
    52
    Ok, scratch that I just checked again I cannot actually change the data, just view it. Thanks for the help.
    Reply With Quote Reply With Quote
  7. 05-09-2003, 01:07 PM #7
    rmiao
    rmiao is offline Registered User
    Join Date
    Sep 2002
    Posts
    5,938
    You may have guest user in the db, can delete it if you don't want other users without permission to view data in the db.
    Reply With Quote Reply With Quote
  8. 05-09-2003, 02:32 PM #8
    Katyan
    Katyan is offline Registered User
    Join Date
    Oct 2002
    Location
    Trinidad
    Posts
    52
    Ray, you're quite correct. Removing the guest account solved the problem.

    Thanks again
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules