Data Flow Task Problem: d99

Showing posts with label d99_tmp. Show all posts

Friday, February 17, 2012

d99_tmp table?

i noticed a table named 'd99_tmp' appeared in one of my SQL db from nowhere.
the fields are 'subdirectory', 'dept' and 'file'. And it contains info about
my server harddisk file information.
Does anyone knows where this table comes from?This is a User Created Table.
sp_help d99_tmp: This will help you to find who has created the table and
when?
sp_spaceused d99_tmp: This will tell size of the table and Row Count.
"twlancer" wrote:
> i noticed a table named 'd99_tmp' appeared in one of my SQL db from nowhere.
> the fields are 'subdirectory', 'dept' and 'file'. And it contains info about
> my server harddisk file information.
> Does anyone knows where this table comes from?|||I know the which account was used to create this table. but none of my team
members did it. We changed the password and the table reappear days later.
"Absar Ahmad" wrote:
> This is a User Created Table.
> sp_help d99_tmp: This will help you to find who has created the table and
> when?
> sp_spaceused d99_tmp: This will tell size of the table and Row Count.
> "twlancer" wrote:
> > i noticed a table named 'd99_tmp' appeared in one of my SQL db from nowhere.
> > the fields are 'subdirectory', 'dept' and 'file'. And it contains info about
> > my server harddisk file information.
> >
> > Does anyone knows where this table comes from?|||If noone is owning up to it and it reappears after dropping, trace it or
disable the account and see what fails.
"twlancer" <twlancer@.discussions.microsoft.com> wrote in message
news:39B5254C-87EE-478A-B006-1B80329681A8@.microsoft.com...
>I know the which account was used to create this table. but none of my team
> members did it. We changed the password and the table reappear days later.
> "Absar Ahmad" wrote:
>> This is a User Created Table.
>> sp_help d99_tmp: This will help you to find who has created the table and
>> when?
>> sp_spaceused d99_tmp: This will tell size of the table and Row Count.
>> "twlancer" wrote:
>> > i noticed a table named 'd99_tmp' appeared in one of my SQL db from
>> > nowhere.
>> > the fields are 'subdirectory', 'dept' and 'file'. And it contains info
>> > about
>> > my server harddisk file information.
>> >
>> > Does anyone knows where this table comes from?|||How do I trace? I checked the SQL log and couldnt see any entries on this
d99_tmp table.
"Danny" wrote:
> If noone is owning up to it and it reappears after dropping, trace it or
> disable the account and see what fails.
> "twlancer" <twlancer@.discussions.microsoft.com> wrote in message
> news:39B5254C-87EE-478A-B006-1B80329681A8@.microsoft.com...
> >I know the which account was used to create this table. but none of my team
> > members did it. We changed the password and the table reappear days later.
> >
> > "Absar Ahmad" wrote:
> >
> >> This is a User Created Table.
> >>
> >> sp_help d99_tmp: This will help you to find who has created the table and
> >> when?
> >>
> >> sp_spaceused d99_tmp: This will tell size of the table and Row Count.
> >>
> >> "twlancer" wrote:
> >>
> >> > i noticed a table named 'd99_tmp' appeared in one of my SQL db from
> >> > nowhere.
> >> > the fields are 'subdirectory', 'dept' and 'file'. And it contains info
> >> > about
> >> > my server harddisk file information.
> >> >
> >> > Does anyone knows where this table comes from?
>
>|||Use Profiler to trace.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"twlancer" <twlancer@.discussions.microsoft.com> wrote in message
news:3ABA6BE8-99BB-4454-B053-C7B98804DEBC@.microsoft.com...
> How do I trace? I checked the SQL log and couldnt see any entries on this
> d99_tmp table.
> "Danny" wrote:
>> If noone is owning up to it and it reappears after dropping, trace it or
>> disable the account and see what fails.
>> "twlancer" <twlancer@.discussions.microsoft.com> wrote in message
>> news:39B5254C-87EE-478A-B006-1B80329681A8@.microsoft.com...
>> >I know the which account was used to create this table. but none of my team
>> > members did it. We changed the password and the table reappear days later.
>> >
>> > "Absar Ahmad" wrote:
>> >
>> >> This is a User Created Table.
>> >>
>> >> sp_help d99_tmp: This will help you to find who has created the table and
>> >> when?
>> >>
>> >> sp_spaceused d99_tmp: This will tell size of the table and Row Count.
>> >>
>> >> "twlancer" wrote:
>> >>
>> >> > i noticed a table named 'd99_tmp' appeared in one of my SQL db from
>> >> > nowhere.
>> >> > the fields are 'subdirectory', 'dept' and 'file'. And it contains info
>> >> > about
>> >> > my server harddisk file information.
>> >> >
>> >> > Does anyone knows where this table comes from?
>>|||Sounds like a 3rd party application is creating the table...some sort of
network monitoring thing perhaps given the info being stored. Maybe someone
installed this and pointed the utility to the wrong server/database
combination?
--
Kevin Hill
President
3NF Consulting
www.3nf-inc.com/NewsGroups.htm
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:OsuQ2oB7FHA.3760@.TK2MSFTNGP14.phx.gbl...
> Use Profiler to trace.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "twlancer" <twlancer@.discussions.microsoft.com> wrote in message
> news:3ABA6BE8-99BB-4454-B053-C7B98804DEBC@.microsoft.com...
>> How do I trace? I checked the SQL log and couldnt see any entries on this
>> d99_tmp table.
>> "Danny" wrote:
>> If noone is owning up to it and it reappears after dropping, trace it or
>> disable the account and see what fails.
>> "twlancer" <twlancer@.discussions.microsoft.com> wrote in message
>> news:39B5254C-87EE-478A-B006-1B80329681A8@.microsoft.com...
>> >I know the which account was used to create this table. but none of my
>> >team
>> > members did it. We changed the password and the table reappear days
>> > later.
>> >
>> > "Absar Ahmad" wrote:
>> >
>> >> This is a User Created Table.
>> >>
>> >> sp_help d99_tmp: This will help you to find who has created the table
>> >> and
>> >> when?
>> >>
>> >> sp_spaceused d99_tmp: This will tell size of the table and Row Count.
>> >>
>> >> "twlancer" wrote:
>> >>
>> >> > i noticed a table named 'd99_tmp' appeared in one of my SQL db from
>> >> > nowhere.
>> >> > the fields are 'subdirectory', 'dept' and 'file'. And it contains
>> >> > info
>> >> > about
>> >> > my server harddisk file information.
>> >> >
>> >> > Does anyone knows where this table comes from?
>>
>|||i have the same problem, something has created d99_tmp table in sql 2000
database (with c:\ listing in table). Table was created with login that use
my web site to read and write data (nothing else), so i think its some sort
of hack. Or some automatic hacking/checking tools. Know someone something
more about it?|||"sql2000" <thakx@.hi.com> wrote in message
news:bc15216f81d1471cac3a652d8eb0fdfb@.ureader.com...
>i have the same problem, something has created d99_tmp table in sql 2000
> database (with c:\ listing in table). Table was created with login that
> use
> my web site to read and write data (nothing else), so i think its some
> sort
> of hack. Or some automatic hacking/checking tools. Know someone something
> more about it?
Do you have xp_cmdshell enabled? How much permissions does that web account
have? Does your web server use dynamic SQL?
David|||I'd like to hear if anyone has more information on this issue. I also have a
D99_Tmp table in my database that was created by the user that my web
appication uses. The table contains a directory listing of the "D" drive on
the database server as shown below:
subdirectory depth file
Microsoft SQL Server 1 0
RECYCLER 1 0
System Volume Information 1 0
tlogs_backup 1 0
WUTemp 1 0
This appears to be a SQL injection exploit. What is suprising to me is the
directory listing is correct. The user is a SQL user and not a windows user.
The database server is behind a firewall and can only be accessed via the web
application. Comments? Info? Ideas?

d99_tmp table?

d99_tmp

I noticed a table named 'd99_tmp' in my SQL Server 2000 db. I nor
anyone on my team creatd the this table. The fields are
'subdirectory', 'depth' and 'file'. It contains basically the entire
file structure of the D: drive on the server.
The table has the permissions of the web application that uses that
SQL Server database.
This appears to be a SQL Injection attack and I know that there is
some dynamic SQL used in the application.
Any suggestions (other than removing all of the public facing dynamic
SQL)?
Thanks!Hi
"gdunnjr" wrote:
> I noticed a table named 'd99_tmp' in my SQL Server 2000 db. I nor
> anyone on my team creatd the this table. The fields are
> 'subdirectory', 'depth' and 'file'. It contains basically the entire
> file structure of the D: drive on the server.
> The table has the permissions of the web application that uses that
> SQL Server database.
> This appears to be a SQL Injection attack and I know that there is
> some dynamic SQL used in the application.
> Any suggestions (other than removing all of the public facing dynamic
> SQL)?
> Thanks!
>
Check out http://www.sommarskog.se/dynamic_sql.html#SQL_injection and the
rest of the article about dynamic SQL. Make sure that overall you have
tightened up permissions so the minimum access is granted to provide the
functionality required. You could run Best Practice Analyser
http://www.microsoft.com/downloads/details.aspx?FamilyId=B352EB1F-D3CA-44EE-893E-9E07339C1F22&displaylang=en and the Microsoft Security Assessment
Tool https://www.securityguidance.com/faq.htm reading the Windows Server
2003 Security Guide may also help
http://www.microsoft.com/downloads/details.aspx?FamilyID=8A2643C1-0685-4D89-B655-521EA6C7B4DB&displaylang=en
John|||"John Bell" <jbellnewsposts@.hotmail.com> wrote in message
news:172DFD61-F6D1-496A-B591-79B4B3F1EF0A@.microsoft.com...
> Hi
> "gdunnjr" wrote:
>> I noticed a table named 'd99_tmp' in my SQL Server 2000 db. I nor
>> anyone on my team creatd the this table. The fields are
>> 'subdirectory', 'depth' and 'file'. It contains basically the entire
>> file structure of the D: drive on the server.
>> The table has the permissions of the web application that uses that
>> SQL Server database.
>> This appears to be a SQL Injection attack and I know that there is
>> some dynamic SQL used in the application.
>> Any suggestions (other than removing all of the public facing dynamic
>> SQL)?
Exactly that. :-)
But also make sure the user doesn't have DDL permissins like that.
Won't prevent all SQL Injection attacks, but if the user can't
create/drop/alter tables (or execute xp_cmdshell) you'll be a lot better
off.
>> Thanks!
> Check out http://www.sommarskog.se/dynamic_sql.html#SQL_injection and the
> rest of the article about dynamic SQL. Make sure that overall you have
> tightened up permissions so the minimum access is granted to provide the
> functionality required. You could run Best Practice Analyser
> http://www.microsoft.com/downloads/details.aspx?FamilyId=B352EB1F-D3CA-44EE-893E-9E07339C1F22&displaylang=en
> and the Microsoft Security Assessment
> Tool https://www.securityguidance.com/faq.htm reading the Windows Server
> 2003 Security Guide may also help
> http://www.microsoft.com/downloads/details.aspx?FamilyID=8A2643C1-0685-4D89-B655-521EA6C7B4DB&displaylang=en
> John
Greg Moore
SQL Server DBA Consulting Remote and Onsite available!
Email: sql (at) greenms.com http://www.greenms.com/sqlserver.html|||Thanks for the information. I verified that the application user does
not have access to xp_cmdshell.
But the application user is assigned the role "db_owner". I would like
to remove that role and assign the roles: db_reader and db_writer.
I know that db_owner lets you execute DDL statements, but what are the
other major priviliges the user lose and/or risks of changing the user
from db_owner to db_reader and db_writer?
On Apr 12, 9:56 am, "Greg D. Moore \(Strider\)"
<mooregr_deletet...@.greenms.com> wrote:
> "John Bell" <jbellnewspo...@.hotmail.com> wrote in message
> news:172DFD61-F6D1-496A-B591-79B4B3F1EF0A@.microsoft.com...
>
>
> > Hi
> > "gdunnjr" wrote:
> >> I noticed a table named 'd99_tmp' in mySQLServer 2000 db. I nor
> >> anyone on my team creatd the this table. The fields are
> >> 'subdirectory', 'depth' and 'file'. It contains basically the entire
> >> file structure of the D: drive on the server.
> >> The table has the permissions of the web application that uses that
> >>SQLServer database.
> >> This appears to be aSQLInjectionattack and I know that there is
> >> some dynamicSQLused in the application.
> >> Any suggestions (other than removing all of the public facing dynamic
> >>SQL)?
> Exactly that. :-)
> But also make sure the user doesn't have DDL permissins like that.
> Won't prevent allSQLInjectionattacks, but if the user can't
> create/drop/alter tables (or execute xp_cmdshell) you'll be a lot better
> off.
>
> >> Thanks!
> > Check outhttp://www.sommarskog.se/dynamic_sql.html#SQL_injectionand the
> > rest of the article about dynamicSQL. Make sure that overall you have
> > tightened up permissions so the minimum access is granted to provide the
> > functionality required. You could run Best Practice Analyser
> >http://www.microsoft.com/downloads/details.aspx?FamilyId=B352EB1F-D3C...
> > and the Microsoft Security Assessment
> > Toolhttps://www.securityguidance.com/faq.htmreading the Windows Server
> > 2003 Security Guide may also help
> >http://www.microsoft.com/downloads/details.aspx?FamilyID=8A2643C1-068...
> > John
> --
> Greg MooreSQLServer DBA Consulting Remote and Onsite available!
> Email:sql (at) greenms.com http://www.greenms.com/sqlserver.html- Hide quoted text -
> - Show quoted text -|||"gdunnjr" <gdunnjr@.gmail.com> wrote in message
news:1176467724.629968.31880@.y5g2000hsa.googlegroups.com...
> Thanks for the information. I verified that the application user does
> not have access to xp_cmdshell.
> But the application user is assigned the role "db_owner". I would like
> to remove that role and assign the roles: db_reader and db_writer.
> I know that db_owner lets you execute DDL statements, but what are the
> other major priviliges the user lose and/or risks of changing the user
> from db_owner to db_reader and db_writer?
Make sure the user has all stored procs, functions execution privileges (at
least all it should.)
> On Apr 12, 9:56 am, "Greg D. Moore \(Strider\)"
> <mooregr_deletet...@.greenms.com> wrote:
>> "John Bell" <jbellnewspo...@.hotmail.com> wrote in message
>> news:172DFD61-F6D1-496A-B591-79B4B3F1EF0A@.microsoft.com...
>>
>>
>> > Hi
>> > "gdunnjr" wrote:
>> >> I noticed a table named 'd99_tmp' in mySQLServer 2000 db. I nor
>> >> anyone on my team creatd the this table. The fields are
>> >> 'subdirectory', 'depth' and 'file'. It contains basically the entire
>> >> file structure of the D: drive on the server.
>> >> The table has the permissions of the web application that uses that
>> >>SQLServer database.
>> >> This appears to be aSQLInjectionattack and I know that there is
>> >> some dynamicSQLused in the application.
>> >> Any suggestions (other than removing all of the public facing dynamic
>> >>SQL)?
>> Exactly that. :-)
>> But also make sure the user doesn't have DDL permissins like that.
>> Won't prevent allSQLInjectionattacks, but if the user can't
>> create/drop/alter tables (or execute xp_cmdshell) you'll be a lot better
>> off.
>>
>> >> Thanks!
>> > Check outhttp://www.sommarskog.se/dynamic_sql.html#SQL_injectionand the
>> > rest of the article about dynamicSQL. Make sure that overall you have
>> > tightened up permissions so the minimum access is granted to provide
>> > the
>> > functionality required. You could run Best Practice Analyser
>> >http://www.microsoft.com/downloads/details.aspx?FamilyId=B352EB1F-D3C...
>> > and the Microsoft Security Assessment
>> > Toolhttps://www.securityguidance.com/faq.htmreading the Windows Server
>> > 2003 Security Guide may also help
>> >http://www.microsoft.com/downloads/details.aspx?FamilyID=8A2643C1-068...
>> > John
>> --
>> Greg MooreSQLServer DBA Consulting Remote and Onsite available!
>> Email:sql (at) greenms.com
>> http://www.greenms.com/sqlserver.html- Hide quoted text -
>> - Show quoted text -
>
Greg Moore
SQL Server DBA Consulting Remote and Onsite available!
Email: sql (at) greenms.com http://www.greenms.com/sqlserver.html

Friday, February 17, 2012

d99_tmp table?

d99_tmp table?

d99_tmp table?

d99_tmp

d99_tmp

d99_tmp

Data Flow Task Problem

Blog Archive

About Me