DoD STIGs – V-32571

Overview:

Title: The DBMS must restrict error messages, so only authorized personnel may view them.

Vulnerability ID: V-32571

STIG ID:

IA Controls: None

Severity: medium

Description: If the application provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.

Some default DBMS error messages can contain information that could aid an attacker in, among others things, identifying the database type, host address, or state of the database. Custom errors may contain sensitive customer information. It is important that error messages are displayed only to those who are authorized to view them.

Check Text: Check DBMS settings and custom database code to determine if error messages are ever displayed to unauthorized individuals. If error messages are displayed to individuals not authorized to view them, this is a finding.

Fix Text: Configure DBMS and custom database code to not display error messages to those not authorized to view them.

[divider]

Interpreting V-32571:

Handling error messages within application code and SQL Server stored procedures and other objects comes down to proper enforcement of guidelines and code review practices being in place.

As for errors generated and captured by SQL Server itself that write to the SQL or system error logs, access can be controlled by ensuring proper security permissions are in place.

Users granted the security admin or sysadmin level of permission are able to use the SSMS GUI to open the SQL Server logs located under the Management section of the object browser. There is also an undocumented system stored procedure, named sp_readerrorlog, that, if a user is granted execute on, will access the SQL Server error logs as. This is an undocumented procedure and therefore should not be referenced by any users of the system at any time.

The SQL Server erro logs are alos stored on the local system in the SQL Server installation folders. Access should be restricted to those directories as well.

To ensure compliance you would need to ensure only those with proper authorized permission have access to the tools or the directories containing the files.

Return to the DoD STIGs – Database Security Requirements Guide

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.