SQL DeCryptor 2.2 (Windows)

SQL Decryptor is developed by Imperia Software, to decrypt views, user defined functions and stored procedures in an easy-to-use graphical interface. It works quickly to decrypt items in Microsoft SQL Server 6.5, 7.0, 2000, 2005, 2008 and MSDE. SQL Decryptor allows for easy viewing of encrypted code, of any size.Version 2.2 with best search performance.

Microsoft confirms it's been working on SQL Server bug since April

Microsoft Corp. today confirmed that it has been working on a critical vulnerability in SQL Server for more than eight months, but declined to say whether it has had a patch ready since September, as an Austrian security researcher has alleged.

On Monday, the company warned customers of a bug that could be used to compromise servers running older versions of the database software, which is widely used to power Web sites and applications.

"Microsoft opened an investigation for this vulnerability in April upon the initial report by the security researcher," said a company spokesman in an e-mail today. "We immediately started an investigation and have been working on this issue since that time," he added.

The researcher, Bernhard Mueller of SEC Consult Security, a Vienna-based security consulting company, went public with details of the vulnerability as well as an exploit code on Dec. 9, apparently after tiring of Microsoft's lack of communication.

According to Mueller, who posted findings in an advisory on the SEC Consult site, as well as to prominent security mailing lists, the bug was reported to Microsoft on April 17, 2008, and Microsoft's last message to him was on Sept. 29. After four requests for an update on a patch's status during October and November, Mueller disclosed the vulnerability.

Mueller also said that Microsoft had informed him in September that it had completed a fix.

The Microsoft spokesman didn't directly respond to a question about whether the company had a patch in hand, as Mueller claimed, but instead said, "At this time, security updates are not available for the affected versions listed in Microsoft Security Advisory 961040."

Although it is true that Microsoft has not yet issued an update to the affected software -- which includes SQL Server 2000, SQL Server 2005, SQL Server 2005 Express Edition, SQL Server 2000 Desktop Engine, Microsoft SQL Server 2000 Desktop Engine and Windows Internal Database -- one security expert said he's betting that the company will release one soon.

Internals of SQL Cluster Setup and Troubleshooting Tips

Unlike Exchange Cluster Setup process, SQL Cluster Setup process is not tricky. You just click on next and finish the setup. The purpose of this article series is to explain the internals of the SQL Cluster Setup. The Setup process executes couple of functions from its Setup DLL. These functions are internal to SQL Setup and are never exposed to the user running the setup. The functions it executes are used to decide whether SQL Setup should install the SQL Database Instance in a stand-alone environment or in a cluster environment.

SQL Server Setup Functions
How does SQL Server cluster setup configure a second node to be cluster-aware?
What all-registry entries are created during the setup and their importance in a SQL Cluster environment?
I will start with the first topic mentioned in the above list.

SQL Server Setup Functions
SQL Setup mainly uses the SQLCluster.DLL from its BINN Directory to execute the following functions in it: DoSQLClusterSetUpWork
DoUnClusterSetup
CheckDatabasesForInstance

Introduction to Policy-Based Management in SQL Server 2008

New to SQL Server 2008 is Policy-Based Management. This new technology allows for defining polices to ensure your database guidelines are met. In this article, SQL Server consultant Tim Chapman gives an overview of this new technology.

————————————————————————————–






Policy-Based Management in SQL Server 2008 allows the database administrator to define policies that tie to database instances and objects. These policies allow the Database Administrator (DBA) to specify rules for which objects and their properties are created, or modified. An example of this would be to create a database-level policy that disallows the AutoShrink property to be enabled for a database. Another example would be a policy that ensures the name of all table triggers created on a database table begins with tr_.



As with any new SQL Server technology (or Microsoft technology in general), there is a new object naming nomenclature associated with Policy-Based Management. Below is a listing of some of the new base objects.

PolicyA Policy is a set of conditions specified on the facets of a target. In other words, a Policy is basically a set of rules specified for properties of database or server objects.

TargetA Target is an object that is managed by Policy-Based Management. Includes objects such as the database instance, a database, table, stored procedure, trigger, or index.

FacetA Facet is a property of an object (target) that can be involved in Policy Based Management. An example of a Facet is the name of a Trigger or the AutoShrink property of a database.

Microsoft's SQL Injection Protection

Homer Simpson may have enjoyed his hot beef injections (for Homer these were hot dogs), but he would be far less fond of SQL injections, attacks upon SQL Server that can cripple Web sites.

Many with SQL Server also have IIS, which is why Microsoft is beefing up IIS with SQL Injection protections. The new filter against these attacks is free and available now.

From all indications Small Business Server 2003 was a fine product -- easy to set up, easy to use and boasting many essential business features. As I recall, the only drawback was if your company outgrew the SBS product, it was hard to move up gracefully.

The new version of the server, SBS 2008, is now in the hands of hardware makers who expect to have it bundled up by November. I guess they want to take their time and get it perfect.

Do you use SBS? What do you like and what don’t you? Answers welcome at dbarney@redmondmag.com.

Slam these SQL Injection Attacks!

In January 2003, the Microsoft SQL Server community got a massive wake-up call. The SQL Slammer hit the internet. This denial-of-service virus brought down many database servers including those at Bank of America and Microsoft itself. The solution was to apply SQL Server 2000 SP3 which by pure coincidence had been released 10 days earlier. The actual hotfix had been available for 6 months or more but in those days many DBAs just waited for the next Service Pack. Big mistake! Attacks like this prompted Bill Gates to launch the Trustworthy Computing initiative and current project plans were elongated by 3 months to allow product teams to focus on security. Products under development included Windows Server 2003, Exchange 2003 and SQL Server 2005 - they all benefited from this "strategy".

But what about SQL Injection attacks?

SQL Injection attacks take advantage of poorly coded applications by submitting hidden code "injected" into a seemingly harmless piece of code. The solution is to make sure input fields from an application are fully validated including checking for special characters before they are used in SQL commands. Recently, this vulnerability has emerged in many ASP applications so Microsoft have produced a utility that will check ASP code for potential vulnerabilities.

Microsoft Source Code Analyzer for SQL Injection:

http://www.microsoft.com/downloads/details.aspx?FamilyID=58a7c46e-a599-4fcb-9ab4-a4334146b6ba&DisplayLang=en%20

Check it out!

SQL Server 2008 may not come in August after all

Microsoft SQL Server is a relational database management system whose primary query language is Transact-SQL. The latest version of the Microsoft database platform is Microsoft SQL Server 2005 SP2, but Microsoft has for a while now been working on what was previously codenamed Katmai. Microsoft is planning to release the long-awaited Microsoft SQL Server 2008 (overview) sometime during the third quarter of this year.

At the Microsoft Worldwide Partner Conference, the company announced to partners that the new version is now listed on the August price list. Pricing is to remain the same as it is with SQL Server 2005. Various news sites took this information and ran with it: many began to report that SQL Server 2008 was becoming available in August, but this is not necessarily true.

Microsoft is still expecting the new version to arrive sometime in Q3. As Andrew Fryer put it on his blog: "Bottom line—It will be out sometime in Q3 when it’s ready," the fact that it is available on August's price list does not guarantee that it will become available then. It is entirely possible that the new version will launch just at the end of Q3 (late September), and even then, you can never rule out delays with Microsoft. Currently, the latest build is RC0 (released in early June). Once it is finally released, Microsoft has previously said that SP3 for SQL Server 2005 will arrive, hopefully in Q4.