Pwdencrypt() Weakness

By Bill Graziano on 10 July 2002 | Tags: Security


Uberbloke submitted From "The Register" The inner workings of the undocumented pwdencrypt() hash function in Microsoft SQL Server have been revealed in a paper by security researcher David Litchfield of Next Generation Security Software (NGSS). Sort of thing that we ought to know about, I suppose. Thanks! The article is really a scare piece. It's really only a problem if you're already a system administrator on SQL Server. The other issue is if you used pwdencrypt() to secure other data in SQL Server. Turns out it's not quite that secure.

Link: Pwdencrypt() Weakness


Related Articles

Alerts for when Login Failures Strike (14 July 2008)

SQL Server Connection Strings (14 November 2007)

Understanding the Difference between Owners and Schemas in SQL Server (5 October 2007)

Improving Data Security by Using SQL Server 2005 (28 October 2005)

10 Steps to Help Secure SQL Server 2000 (16 September 2003)

MS Security Vulnerability (11 September 2003)

MS Response to the Slammer Worm (26 January 2003)

Building and Configuring More Secure Web Sites (21 December 2002)

Other Recent Forum Posts

Install visual studio and MS SQL server (83m)

Find data source of created SSRS report (19h)

MySQL Union of multiple tables with different number of columns, ordered by another table to get the changed columns name (1d)

How do I group individual events by year? (2d)

Why Am I unable to request Forgotten Password? (2d)

FileTables or Remote BLOB Store SQL Server 2017 (2d)

SQL JSON_Query is not working as expected when using case with For Json Auto or For Json Path (2d)

Patients_summative (2d)

- Advertisement -