Security Issue on Remote Connection to SQL server

Customer Support Customer Only Discussion
1

Dear Jodohost Tech Team,

I have SQL Server 2003 on a local computer that I use for developing and testing.

I just made a connection to the MSSQL Server on Judo Servers using “SQL Server Management Studio” for import/restore data from local DB to the remote DB, and I was surprised to see ALL THE DATABASES that is locating on the remote server.
I was not able to open them but if some one with bad attentions’ will work on the server, it is just a meter of short time for hacking the server.

I also was able to explore all the hard discs drivers on the computer server by using the RESTOR Tool of the SQL Server 2003 on my local pc.

Please be advised.

2

Nothing new here, we know of this :slight_smile:

Nothing we can do to prevent it in sql 2005 management tools from viewing 2000 databases or HD structure.

You dont have permissions to do anything, and it used to be that all databases showed to everyone on all tools, so it is much better than it used to be.

3

thought it will be help to know.

4

No problem with you reporting it, but we do know of it, and it has been mentioned elsewhere in the forums, but a quick search I did not pull it up.

5

I know this is going back a while, but I’ve just started using Microsoft SQL Server Management Studio, and was shocked to see all the databases.

A quick search on Google, and I more or less pulled up quite a few sites that I’d bet my money on that they’re hosted on JodoHost (using MS SQL as a database backend).

Surely this is a bit of a identity breach on anonymous reselling?

6

OLM,

NOthing we can do about it until psoft gets their act together and makes the user DBO at this point we have people begging and pleading and get gripes back about why it cant be done.
But I don’t think they would all be with jodohost, EVERY hsphere host has this issue :slight_smile:

the only way SQl management studio wont show all DBs is if the user is not just db_owner permissions(as we grant) but the database OWNER.

Also note this is a fact for ALL versions of hsphere up to the current alpha versions, they refuse to make this change saying that it woudl allow the user to “change their quota via enterprise manager” and I have repeatedly said there are ways to get the quota, and not only that it is against TOS to change something on the server outside of the set parameters, so if someone wants to abuse a server changing their quota they do not need to be hosted.