STIGQter: STIG Summary: MS SQL Server 2014 Instance Security Technical Implementation Guide Version: 1 Release: 10 Benchmark Date: 24 Apr 2020:

Execution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.

DISA Rule

SV-82377r2_rule

Vulnerability Number

V-67887

Group Title

SRG-APP-000342-DB-000302

Rule Version

SQL4-00-032600

Severity

CAT II

CCI(s)

• CCI-002233 - The information system prevents organization-defined software from executing at higher privilege levels than users executing the software.

Weight

10

Fix Recommendation

Determine where, when, how, and by what principals/subjects elevated privilege is needed.

Modify documentation as necessary to align it with the actual need for privilege elevation.

Modify the database and DBMS security configuration, stored procedures, functions, and triggers, external modules invoked by the DBMS, and the application(s) using the database, so that privilege elevation is used only as required.

Check Contents

Review the system documentation, SQL Server instance and database security configuration, source code for stored procedures, functions, and triggers, source code of external modules invoked by the DBMS, and source code of the application(s) using the database.

If elevation of DBMS privileges is utilized but not documented, this is a finding.

If elevation of DBMS privileges is documented, but not implemented as described in the documentation, this is a finding.

If the privilege-elevation logic can be invoked in ways other than intended, or in contexts other than intended, or by subjects/principals other than intended, this is a finding.

Vulnerability Number

V-67887

Documentable

False

Rule Version

SQL4-00-032600

Severity Override Guidance

Review the system documentation, SQL Server instance and database security configuration, source code for stored procedures, functions, and triggers, source code of external modules invoked by the DBMS, and source code of the application(s) using the database.

If elevation of DBMS privileges is utilized but not documented, this is a finding.

If elevation of DBMS privileges is documented, but not implemented as described in the documentation, this is a finding.

If the privilege-elevation logic can be invoked in ways other than intended, or in contexts other than intended, or by subjects/principals other than intended, this is a finding.

Check Content Reference

M

Target Key

2639

Comments