2.3 Ensure 'Cross DB Ownership Chaining' Server Configuration Option is set to '0'

Information

The cross db ownership chaining option controls cross-database ownership chaining across all databases at the instance (or server) level.

Rationale:

When enabled, this option allows a member of the db_owner role in a database to gain access to objects owned by a login in any other database, causing an unnecessary information disclosure. When required, cross-database ownership chaining should only be enabled for the specific databases requiring it instead of at the instance level for all databases by using the ALTER DATABASE <database_name> SET DB_CHAINING ON command. This database option may not be changed on the master, model, or tempdb system databases.

Solution

Run the following T-SQL command:

EXECUTE sp_configure 'cross db ownership chaining', 0;
RECONFIGURE;
GO


Default Value:

By default, this option is disabled (0).

References:

https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/cross-db-ownership-chaining-server-configuration-option

See Also

https://workbench.cisecurity.org/files/2837

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CSCv6|14.4, CSCv7|14.6

Plugin: MS_SQLDB

Control ID: 6896edef6db8fdcc2288b2ff1beb5cedc1ced361fe401fae84cb81d04c6acb14