Andreas Wolter • 9/24/2009

Security-issue: guest-guest impersonation

The article details a security flaw in SQL Server (versions 2005-2008 R2) where enabling the guest account in multiple databases can lead to guest-guest impersonation. This allows a user (e.g., a developer) in one database to impersonate the local guest, connect to another database with guest enabled, and gain unauthorized permissions, bypassing explicit denials. The issue was reported to Microsoft, with a fix expected only in a future major release (codename 'Denali').

0 comments

#security #SQL Server #Impersonation