Comments on: Defcon 15 http://www.cqure.net/wp/2007/08/defcon-15/ Fri, 05 Dec 2008 10:23:42 +0000 http://wordpress.org/?v=2.6 By: Patrik Karlsson http://www.cqure.net/wp/2007/08/defcon-15/#comment-19313 Patrik Karlsson Wed, 23 Jan 2008 02:46:14 +0000 http://www.cqure.net/wp/?p=52#comment-19313 Hi Erin, I noticed this behaviour in SQL Server 2005 after I applied some of the service packs and updates. This is the reason why I chose the xp_dirtree in order to tunnel my data in DNS. What I noticed was that the xp_fileexists sp worked if you created an OS account and granted it the exact same database permissions as an account residing in the database. I don't know if this still works and if this is an acceptable work around for you. Regards, Patrik Hi Erin,

I noticed this behaviour in SQL Server 2005 after I applied some of the service packs and updates. This is the reason why I chose the xp_dirtree in order to tunnel my data in DNS. What I noticed was that the xp_fileexists sp worked if you created an OS account and granted it the exact same database permissions as an account residing in the database. I don’t know if this still works and if this is an acceptable work around for you.

Regards,
Patrik

]]> By: Erin http://www.cqure.net/wp/2007/08/defcon-15/#comment-18255 Erin Tue, 18 Dec 2007 00:39:02 +0000 http://www.cqure.net/wp/?p=52#comment-18255 Is there a work around for the low privileged database user to be able to run xp_fileexists? This stored proc is used during the restore process, so my low-level users who are dbcreator role can no longer locate backup files. Thanks, Erin Is there a work around for the low privileged database user to be able to run xp_fileexists?

This stored proc is used during the restore process, so my low-level users who are dbcreator role can no longer locate backup files.

Thanks,
Erin

]]>