Unauthorized access to external database objects should be removed from application user roles.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15105	DG0120-SQLServer9	SV-24104r1_rule	ECLP-1	Medium

Description
Access to objects stored and/or executed outside of the DBMS security context may provide an avenue of attack to host system resources not controlled by the DBMS. Any access to external resources from the DBMS can lead to a compromise of the host system or its resources.

STIG	Date
Microsoft SQL Server 2005 Instance Security Technical Implementation Guide	2015-04-03

Details

Check Text ( None )
None

Fix Text (F-18420r1_fix)
Evaluate the associated risk in allowing access to external objects. Consider the security context under which the object is accessed or whether the privileges required to access the object are available for assignment based on job function. Where feasible, modify the application to use only objects stored internally to the database. Where not feasible, note the risk assessment and acceptance in the System Security Plan for access to external objects. Document required access permissions in the System Security Plan and authorize with the IAO.

Fix Text (F-18420r1_fix)

Evaluate the associated risk in allowing access to external objects.

Consider the security context under which the object is accessed or whether the privileges required to access the object are available for assignment based on job function.

Where feasible, modify the application to use only objects stored internally to the database. Where not feasible, note the risk assessment and acceptance in the System Security Plan for access to external objects.

Document required access permissions in the System Security Plan and authorize with the IAO.