Pwdencrypt() Weakness

By Bill Graziano on 10 July 2002 | Tags: Security


Uberbloke submitted From "The Register" The inner workings of the undocumented pwdencrypt() hash function in Microsoft SQL Server have been revealed in a paper by security researcher David Litchfield of Next Generation Security Software (NGSS). Sort of thing that we ought to know about, I suppose. Thanks! The article is really a scare piece. It's really only a problem if you're already a system administrator on SQL Server. The other issue is if you used pwdencrypt() to secure other data in SQL Server. Turns out it's not quite that secure.

Link: Pwdencrypt() Weakness


Related Articles

Alerts for when Login Failures Strike (14 July 2008)

SQL Server Connection Strings (14 November 2007)

Understanding the Difference between Owners and Schemas in SQL Server (5 October 2007)

Improving Data Security by Using SQL Server 2005 (28 October 2005)

10 Steps to Help Secure SQL Server 2000 (16 September 2003)

MS Security Vulnerability (11 September 2003)

MS Response to the Slammer Worm (26 January 2003)

Building and Configuring More Secure Web Sites (21 December 2002)

Other Recent Forum Posts

Return all rows from first table & specific values from joined table? (3d)

Distinct number in column with max value in another column (4d)

SQL System Databases (4d)

Performance improvement - using temp table (4d)

Generate a Create Table Statement with a SQL Query but with Flexible Datatypes (5d)

Filter Date Range (5d)

Beat methods to validate/test the output data with original data (5d)

Access temp tables already created from within dynamic OpenQuery (6d)

- Advertisement -