2.9 Ensure 'SQL Mail XPs' Server Configuration Option is set to '0'

Information

SQL Mail provides a mechanism to send, receive, delete, and process e-mail messages using SQL Server.

Rationale:

SQL Mail, which is deprecated in favor of Database Mail and if disabled reduces the SQL Server surface, eliminates a DOS attack vector and channel to exfiltrate data from the database server to a remote host.

Solution

Run the following T-SQL command:

EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'SQL Mail XPs', 0;
RECONFIGURE;
GO
EXECUTE sp_configure 'show advanced options', 0;
RECONFIGURE;

Default Value:

0 (disabled)


References:

http://msdn.microsoft.com/en-us/library/ms190755(v=sql.105).aspx

http://msdn.microsoft.com/en-us/library/ms190755(v=sql.100).aspx

See Also

https://workbench.cisecurity.org/files/2834

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv6|9.1, CSCv7|9.2

Plugin: MS_SQLDB

Control ID: 69c330464930b501cbbe219eeddf132e11db4a1ccad0da126e56182e0141be40