Pwdencrypt() Weakness

By Bill Graziano on 10 July 2002 | Tags: Security


Uberbloke submitted From "The Register" The inner workings of the undocumented pwdencrypt() hash function in Microsoft SQL Server have been revealed in a paper by security researcher David Litchfield of Next Generation Security Software (NGSS). Sort of thing that we ought to know about, I suppose. Thanks! The article is really a scare piece. It's really only a problem if you're already a system administrator on SQL Server. The other issue is if you used pwdencrypt() to secure other data in SQL Server. Turns out it's not quite that secure.

Link: Pwdencrypt() Weakness


Related Articles

Alerts for when Login Failures Strike (14 July 2008)

SQL Server Connection Strings (14 November 2007)

Understanding the Difference between Owners and Schemas in SQL Server (5 October 2007)

Improving Data Security by Using SQL Server 2005 (28 October 2005)

10 Steps to Help Secure SQL Server 2000 (16 September 2003)

MS Security Vulnerability (11 September 2003)

MS Response to the Slammer Worm (26 January 2003)

Building and Configuring More Secure Web Sites (21 December 2002)

Other Recent Forum Posts

Transfer to new windows 11 computer (5h)

Pivot data but keep equal number per metric (3d)

Change Font Size In T-SQL Message Window? (4d)

Who has joined and who has left (6d)

Linked Server Selection Query Fails with "MS DTC has stopped this transaction" (10d)

Query almost perfect but brings wrong record (11d)

Installing integration Services with Web edition (12d)

Can I add dynamic WHERE clause to this query? (12d)

- Advertisement -