SQL Attack?
- From: "SBC" <tjs@xxxxxxxxxxxxxxxxxxxx>
- Date: Sun, 29 Jul 2007 03:41:01 GMT
I am running SBS 2003 r2 Premium. and have been getting the follwing entries
in my SQL event log every few days for about the last week..
The server is patched and port 1433 is closed in ISA. Here are a sample of
the entires below. The attempts in spurts of about 20 tries.
Any insight or suggestions would be appreciated.
Thanks,
Tom
07/28/2007 09:00:06,spid54,Unknown,SQL Server blocked access to procedure
'sys.xp_cmdshell' of component 'xp_cmdshell'
because this component is turned off as part of the security configuration
for this server. A system administrator can enable the
use of 'xp_cmdshell' by using sp_configure. For more information about
enabling 'xp_cmdshell'<c/> see "Surface Area Configuration"
in SQL Server Books Online.
07/28/2007 08:33:03,spid54,Unknown,SQL Server blocked access to procedure
'sys.xp_cmdshell' of component 'xp_cmdshell'
because this component is turned off as part of the security configuration
for this server. A system administrator can enable the
use of 'xp_cmdshell' by using sp_configure. For more information about
enabling 'xp_cmdshell'<c/> see "Surface Area Configuration"
in SQL Server Books Online.
07/28/2007 08:32:25,Logon,Unknown,Login failed for user
'64.27.135.106FoundMssqlaccoun:sa'. [CLIENT: 84.102.7.40]
07/28/2007 08:32:25,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State:
5.
07/28/2007 00:06:53,Logon,Unknown,Login failed for user 'admin'. [CLIENT:
210.182.67.8]
07/28/2007 00:06:53,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State:
5.
07/28/2007 00:06:53,Logon,Unknown,Login failed for user 'admin'. [CLIENT:
210.182.67.8]
.
- Follow-Ups:
- Re: SQL Attack?
- From: Leythos
- Re: SQL Attack?
- Prev by Date: new SBS install -- cannot see external network
- Next by Date: Re: new SBS install -- cannot see external network
- Previous by thread: new SBS install -- cannot see external network
- Next by thread: Re: SQL Attack?
- Index(es):
Relevant Pages
|
