Did you have any chance to read the following article?

http://www.derkeiler.com/Newsgroups/microsoft.public.sqlserver.security/2004-03/0227.html