Permissions using the WITH GRANT OPTION should be granted only to DBA or application administrator accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2498	DM5144-SQLServer9	SV-23833r1_rule	ECLP-1	Medium

Description
The WITH GRANT option assigned with privileges, allows the grantee of the privilege to re-grant the privilege to other accounts. Unauthorized or unmanaged assignment of privileges may result in a compromise of data confidentiality and database operation. Privilege assignment should be restricted to DBA, application object owner accounts and application administration accounts.

STIG	Date
Microsoft SQL Server 2005 Database Security Technical Implementation Guide	2015-04-03

Details

Check Text ( None )
None

Fix Text (F-2479r1_fix)
Revoke unauthorized permissions granted with the WITH GRANT option. From the query prompt: USE [Database Name] REVOKE GRANT OPTION FOR [object] FROM [Principal] You may re-grant the object permissions to the Principal as shown below. From the query prompt: USE [Database Name] GRANT [permission] ON [object] TO [Principal] Document required object permission grants with Grant Option in the System Security Plan and authorize with the IAO.

Fix Text (F-2479r1_fix)

Revoke unauthorized permissions granted with the WITH GRANT option.

From the query prompt:

USE [Database Name]
REVOKE GRANT OPTION FOR [object] FROM [Principal]

You may re-grant the object permissions to the Principal as shown below.

From the query prompt:

USE [Database Name]
GRANT [permission] ON [object] TO [Principal]

Document required object permission grants with Grant Option in the System Security Plan and authorize with the IAO.