Home Forums SQL Server 2005 Administering Is xp_cmdshell Security threat??? RE: Is xp_cmdshell Security threat???

  • April 6, 2013 at 12:35 pm

    #1604232

    WayneS (6/22/2009)

    rambilla4 (6/22/2009)

    Hi,

    We are using xp-cmdshell for deleting old backups. But I heard that xp_cmdshell is a big security threat for SQL Server. Is it true?

    That depends. Do you consider this code a threat?

    exec master..xp_cmdshell 'FORMAT C:'

    I know this is a wicked old thread but I have to ask... who can use that command? The answer is "Only people with SA privs" or people that the DBAs where stupid enough to grant a direct execution proxy to.

    That being said and assuming that no one and no thing but the DBAs have the privs to execute xp_CmdShell, why do you think xp_CmdShell provides a security threat?

    --Jeff Moden

    RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
    First step towards the paradigm shift of writing Set Based code:
    ________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

    Change is inevitable... Change for the better is not.

    Helpful Links:
    How to post code problems
    How to Post Performance Problems
    Create a Tally Function (fnTally)