?? 3273.txt
字號:
Rule: --Sid:3152-- Summary: This event is generated when an attempt is made to access a host runningMicrosoft SQL Server or utilizing MSDE via the default "sa" account.-- Impact: Information disclosure. Unauthorized access to the host.--Detailed Information:This event is generated when an attempt is made to access a host via the"sa" account using brute force techniques to guess a password.Microsoft SQL server and MSDE components use a default "sa" account witha default password as the administrative user for the databaseinstallation. This event indicates that numerous failed attempts havebeen made to access the target host using this account.--Affected Systems: Microsoft SQL Server 2000 Microsoft SQL Server 7.0 Systems using Microsoft MSDE components--Attack Scenarios: An attacker can use an automated script to gain access to a host and thedatabase contents as an administrator by repeatly attempting to loginusing the "sa" account and different passwords.Some worms also try to brute force entry using this methodology.-- Ease of Attack: Simple,-- False Positives: None Known--False Negatives: None Known-- Corrective Action: Apply the appropriate vendor supplied patchesChange the default "sa" passwordDisable the "sa" account.--Contributors: Sourcefire Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>-- Additional References:--
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -