Microsoft Search service vulnerabilities

I am working on a "best practices" document for my company and came across
the suggestion to disable any unnecessary SQL Server services. We do not us
e
full-text search so we have no need for the service. However, I would like
to be able to provide reasons why this service should be disabled. I've
searched for vulnerabilites related to the Microsoft Search service and have
come up empty. Does anyone know of any vulnerabilities?
Thanks!I'm not aware of any vulnerabilities but it's still a good idea to shut it
down if you know you are not going to use it. That way, if someone comes up
with an attack later, you aren't at risk. Reducing the surface that an
attacker can attack to only what's required is always a good idea.
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"cltdba" <cltdba@.discussions.microsoft.com> wrote in message
news:14FA55C3-C274-458F-B7A8-ABB90EAD3E2C@.microsoft.com...
>I am working on a "best practices" document for my company and came across
> the suggestion to disable any unnecessary SQL Server services. We do not
> use
> full-text search so we have no need for the service. However, I would
> like
> to be able to provide reasons why this service should be disabled. I've
> searched for vulnerabilites related to the Microsoft Search service and
> have
> come up empty. Does anyone know of any vulnerabilities?
> Thanks!

Microsoft Responds To Serious Credibility Issues...

I think Microsoft really deserves credit for responding to questions
regarding the company's ability to produce secure and robust versions of SQL
Server 2005 and Visual Studio 2005.
Microsoft's representatives respond [1].
<%= Clinton Gallagher
METROmilwaukee (sm) "A Regional Information Service"
NET csgallagher AT metromilwaukee.com
URL http://metromilwaukee.com/
URL http://clintongallagher.metromilwaukee.com/
[1] http://www.escapeyesterworld.com/yes
MS does respond to queries and suggestions.
they also try to implement certain features, based on user's feedback
best Regards,
Chandra
http://www.SQLResource.com/
http://chanduas.blogspot.com/
---
*** Sent via Developersdex http://www.examnotes.net ***|||One time, at band camp...|||Most server and application security issues could be solved if people would
just learn to RTFM.
"clintonG" < csgallagher@.REMOVETHISTEXTmetromilwaukee
.com> wrote in message
news:eNeF4%23dnFHA.1148@.TK2MSFTNGP12.phx.gbl...
>I think Microsoft really deserves credit for responding to questions
>regarding the company's ability to produce secure and robust versions of
>SQL Server 2005 and Visual Studio 2005.
> Microsoft's representatives respond [1].
> <%= Clinton Gallagher
> METROmilwaukee (sm) "A Regional Information Service"
> NET csgallagher AT metromilwaukee.com
> URL http://metromilwaukee.com/
> URL http://clintongallagher.metromilwaukee.com/
> [1] http://www.escapeyesterworld.com/
>

Meta Data services?

Hi

I'm very new to SQL Server 2000. I'm a student applied informatics and for my personal training I work in a software company.

My job exists of learning & using MS SQL Server 2000. I worked a lot and SQL Server 2000 works well.

The only thing I really don't understand is META DATA SERVICES !

So, my question to ...

What is the purpose of Meta data
How can I manage meta data in SQL Server 2000
Where can I find some good resources for learning to work with meta data in SQL Server 2000.

Thanks !!!

JHi

Is this topic so difficult?

I always heard that meta data was an important step in devellopement?

Is this true or not?|||Meta Data are the data of the data... What does it mean? Well, you need to store information to define a column in a table, like varchar(50) NULL. This information are called Meta Data.

The use of it? The other day I built a fast web form that had to validate the size of the string the user was entering. Depending of the option selected, I had to insert the string in a varchar(15), (18), (50) or (65) column. I wrote a stored proc that was returning the size of the field I had to write in, which I put in my MAXLENGTH web tag, using javascript.

So my stored proc reads the meta data of the field I ask for...

Fun isn't it?

Messages stuck in sys.transmission_queue

Hi,

At my company, we're trying to use service broker to create a client-server system where there is a head office machine and multiple outlets registered with that head office. My problem is that sometimes when a branch sends a message to the head office, it just seems to sit in the transmission queue and never gets sent. If I run a script that forcibly ends the conversations on the client machine (with cleanup), storing the message bodies and then resend them, they seem to get through fine.

The way that we send messages is by calling a t-sql stored procedure from a c# application using SqlCommand (don't know if this should make any difference).

If I monitor the Head Office machine and one of the Outlets while this is happening, on the HO I get three events in a row:

Broker: Message Classify (1 - Local) Audit Broker Conversation (2 - No Certificate) Broker: Message Undeliverable (1 - Sequenced Message)
The TextData contained in the third event is: This message could not be delivered because the security context could not be retrieved.

The RoleName of the server is Initiator, and the TargetUserName is the name of the service on the Outlet.

On the Outlet I get the following event repeatedly (presumably as it continues to try sending the message) - Broker: Remote Message Acknowledgement (1 - Message With Acknowledgement Sent).

On the client the RoleName also appears to be Initiator, and the TargetUserName is blank.

This would make me suspect that certificates were missing or something, except that if I remove messages from the queue and resend them they seem to get through, and also I've checked both databases and they have the correct certificates.

Any ideas?

Thanks in advance,

AdamThanks for the detailed info, it is always helpfull to have the full details when trying to diagnose an issue.
The most likely culprit in such cases is an account that has more certificates to be picked from when encrypting/signing a message. Whenever SSB has more than one certificates 'valid' to be used for a particular database principal, it will pick the one with the latest expiration date. So sometimes even though the configuration 'seems' correct, SSB will pick the 'wrong' certificate simply because it has multiple choices. The typical account prone to this problems is 'dbo', as certs are being created for dbo for various reasons and by default they are all valid for SSB to pick.
To confirm this problem, the 2nd event in your post (the Audit Broker Conversation one) actually tells which certificate was not found: it has the issuer name and serial number of the cert 'not found' on two of the columns (I can't remember now which ones and the BOL 'ommits' this detail). You can then look into the message sender's database to see why that particular cert was picked.
Certs can actualy be controled whether they are available for SSB to 'pick' by turning off the ACTIVE_FOR_BEGIN_DIALOG option on them (the option refers to certs used for the reverse path from target to initiator as well, despite the name 'begin_dalog'...)|||Thanks for the reply. What you're saying makes sense, and seems possible to me (we re-registered one of the outlets recently which could have caused this). The only problem is that the Audit Broker Conversation event doesn't appear to have the issuer or serial number in any of the columns. Maybe I'm using profiler wrong or something, but I would have thought that just selecting the event would have been enough. Any idea what I'm doing wrong?

Adam

|||

IssuerName is DBUserName and SerialNumber is in TargetLoginName.

Make sure the columns above are selected when defining the trace.

|||I had worked out that the IssuerName was DBUserName, but hadn't noticed the serial number. Thanks for explaining that. The thing is that the IssuerName isn't much use to me because the way I generated the certificates, they all have the same name .

But anyhow, I found a solution to the problem. Basically we had an old database on the same server that had broker enabled as well, and I'm guessing that since they both have the same service names in them, that was causing the problems. I disabled service broker on the old db and everything seems to be working again. The only thing I'm worried about now is how the broker became enabled on the database - but that's not really a service broker issue.

Thanks for the help.

Adam
|||

Whenever SSB finds multiple instances of the same service it assumes a load balancing scenario and will hash the incomming conversations to the available service instances. Specifying a broker_instance in the begin dialog from the initiator would make the application stick to a specific service (database), even if more instances of the service show up on the target.