Detections
Analytics

2.17 Ensure 'clr strict security' Server Configuration Option is set to '1'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The clr strict security option specifies whether the engine applies the PERMISSION_SET on the assemblies.

Enabling use of CLR assemblies widens the attack surface of SQL Server and puts it at risk from both inadvertent and malicious assemblies.

Solution

Run the following T-SQL command:

EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'clr strict security', 1;
RECONFIGURE;
GO
EXECUTE sp_configure 'show advanced options', 0;
RECONFIGURE;

Impact:

If CLR assemblies are in use, applications may need to be rearchitected to eliminate their usage before enabling this setting. To find user-created assemblies, run the following query in all databases, replacing <database_name> with each database name:

USE [<database_name>]
 GO
 SELECT name AS Assembly_Name, permission_set_desc
 FROM sys.assemblies
 WHERE is_user_defined = 1;
 GO

See Also

https://workbench.cisecurity.org/benchmarks/24175

Item Details

References: CSCv7|18.9, CSCv7|18.11

Plugin: MS_SQLDB

Control ID: 682f810385cfe23da47dc8f348b5c83d25ed05456d5f2a12eed741ed8c192e8e