Usage of SP_OACreate, SP_OAMethod etc.. is a security risk ?

Posted by TonyP on Stack Overflow See other posts from Stack Overflow or by TonyP
Published on 2010-04-23T12:06:05Z Indexed on 2010/04/23 13:23 UTC
Read the original article Hit count: 351

Filed under:

sql-server

|

tsql

I am told that usage of SP_OACreate , SP_OAMethod in SQL Server 2000 is of a security risk.

I am using Strong Name in the assembly and is stored in GAC on the SQL Server Machine.

What are the security implications/compromise ?

© Stack Overflow or respective owner

Related posts about sql-server

SQL SERVER – Beginning SQL Server: One Step at a Time – SQL Server Magazine

as seen on SQL Authority - Search for 'SQL Authority'
I am glad to announce that along with SQLAuthority.com, I will be blogging on the prominent site of SQL Server Magazine. My very first blog post there is already live; read here: Beginning SQL Server: One Step at a Time. My association with SQL Server Magazine has been quite long, I have written nearly… >>> More
How to install SQL Server 2005 Configuration Manager without installing SQL Server Management Studio

as seen on Server Fault - Search for 'Server Fault'
Hi, I need to configure SQL Server aliases on a public-facing production server. To do that, I need to install SQL Server Configuration Manager. I was not able to find a standalone installer for that, so I am having to install SQL Server 2005 Client Components. This approach is not ideal as we don't… >>> More
[MAJ] SQL Server 2005 Express Edition - La version gratuite de SQL Server 2005

as seen on ASP-PHP.net - Search for 'ASP-PHP.net'
Modification technique pour le site de l'article. >>> More
How to create SQL Server Express DB from SQL Server DB

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a SQL Server 2008 DB. I want to extract SOME tables (and associated schema, constraints, indexes, etc) and create a SQL Server Express DB. It isn't a sync of the target, we stomp on it. We ONLY need to do this in the file system (not across the wire). We are not fond of the synchronization… >>> More
sql server 2000 error, error trying to connect to sql server 2005

as seen on Stack Overflow - Search for 'Stack Overflow'
i am connecting to sql server 2000 on a remote computer with a dotnet application, but when i try to open the connection it gives the following error: When connecting to SQL Server 2005, this failure may be caused by the fact that under the default settings SQL Server does not allow remote connections What… >>> More

Related posts about tsql

TSQL Challenge 30 - A Matrix Transposition challenge in TSQL

as seen on SQL Server Central - Search for 'SQL Server Central'
This is a matrix transposition challenge. Your job is to change the position of the numbres in a 5x5 matrix. SQL Server monitoring made easy "Keeping an eye on our many SQL Server instances is much easier with SQL Response." Mike Lile.Download a free trial of SQL Response… >>> More
Will TSQL become useless because of new ORMs? [closed]

as seen on Programmers - Search for 'Programmers'
By introducing LINQ to SQL, I found myself and my .NET developer colleagues gradually moving from TSQL to C# to create queries on the database. Entity Framework made that shift almost permanent. Now it's nearly 2 years that I use LINQ to SQL and LINQ to Entities and haven't used TSQL that much. Yesterday… >>> More
Issue Creating SQL Login for AppPoolIdentity on Windows Server 2008

as seen on Johnny Coder - Search for 'Johnny Coder'
IIS7 introduced the option to run your application pool as AppPoolIdentity. With the release of IIS7.5, AppPoolIdentity was promoted to the default option. You see this change if you’re running Windows 7 or Windows Server 2008 R2. On my Windows 7 machine, I’m able to define my Application… >>> More
The best, in the West

as seen on Simple Talk - Search for 'Simple Talk'
As many of you know, I run the SQL South West user group and we are currently in full flow preparing to stage the UK’s second SQL Saturday. The SQL Saturday spotlight is going to fall on Exeter in March 2013. We have full-day session on Friday 8th with some truly amazing speakers giving their… >>> More
Something for the weekend - Whats the most complex query?

as seen on SQL Blogcasts - Search for 'SQL Blogcasts'
Whenever I teach about SQL Server performance tuning I try can get across the message that there is no such thing as a table. Does that sound odd, well it isn't, trust me. Rather than tables you need to consider structures. You have 1. Heaps 2. Indexes (b-trees) Some people split indexes… >>> More