SQL6-D0-010100 - SQL Server must reveal detailed error messages only to documented and approved individuals or roles.

Information

If SQL Server provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.

Some default DBMS error messages can contain information that could aid an attacker in, among others things, identifying the database type, host address, or state of the database. Custom errors may contain sensitive customer information.

It is important that detailed error messages be visible only to those who are authorized to view them; that general users receive only generalized acknowledgment that errors have occurred; and that these generalized messages appear only when relevant to the user's task. For example, a message along the lines of, 'An error has occurred. Unable to save your changes. If this problem persists, please contact your help desk.' would be relevant. A message such as 'Warning: your transaction generated a large number of page splits' would likely not be relevant. 'ABGQ is not a valid widget code.' would be appropriate; but 'The INSERT statement conflicted with the FOREIGN KEY constraint 'WidgetTransactionFK'. The conflict occurred in database 'DB7', table 'dbo.WidgetMaster', column 'WidgetCode'' would not, as it reveals too much about the database structure.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by SQL Server, for review by authorized personnel.

If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio, use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles.

If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions.

Consider enabling trace flag 3625 to mask certain system-level error information returned to nonadministrative users.

Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by SQL Server, for review by authorized personnel.

If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio, use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles.

If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions.

Enable trace flag 3625 to mask certain system-level error information returned to nonadministrative users.

To launch SQL Server Configuration Manager, select 'SQL Server Services', select the 'SQL Server', then right-click and select 'Properties'. Select 'Startup Parameters' tab, enter '-T3625', and then click 'Add'. Click 'OK', then restart SQL instance.

To launch SQL Server Configuration Manager, click 'SQL Services', open the instance properties, click the 'Service Parameters' tab, enter '-T3625'. Click 'Add', click 'OK', then restart SQL instance.

Item Details

Audit Name: DISA STIG SQL Server 2016 Instance DB Audit v3r4

Category: SYSTEM AND INFORMATION INTEGRITY

Plugin: MS_SQLDB

Control ID: baa7fd5d7446cefd5a1045f97d250f1492229561983f878b9844dad12525774f

Detections

Analytics

SQL6-D0-010100 - SQL Server must reveal detailed error messages only to documented and approved individuals or roles.

Information

Solution

See Also

Item Details