2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0'

Information

The Database Mail XPs option controls the ability to generate and transmit email messages from SQL Server.

Rationale:

Disabling the Database Mail XPs option reduces the SQL Server surface, eliminates a DOS attack vector and channel to exfiltrate data from the database server to a remote host.

Solution

Run the following T-SQL command:

EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'Database Mail XPs', 0;
RECONFIGURE;
GO
EXECUTE sp_configure 'show advanced options', 0;
RECONFIGURE;

Default Value:

By default, this option is disabled (0).


References:

http://msdn.microsoft.com/en-us/library/ms175887(v=sql.105)

See Also

https://workbench.cisecurity.org/files/2834

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv6|3.1, CSCv7|9.2

Plugin: MS_SQLDB

Control ID: c4cd02d0e1c0e40a4bcea0c9a1577a29069465ac52cd334e394116af1905ad67