2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0'

Information

The Database Mail XPs option controls the ability to generate and transmit email messages from SQL Server.

Rationale:

Disabling the Database Mail XPs option reduces the SQL Server surface, eliminates a DOS attack vector and channel to exfiltrate data from the database server to a remote host.

Solution

Run the following T-SQL command:

EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'Database Mail XPs', 0;
RECONFIGURE;
GO
EXECUTE sp_configure 'show advanced options', 0;
RECONFIGURE;

Default Value:

By default, this option is disabled (0).

References:

https://docs.microsoft.com/en-us/sql/relational-databases/database-mail/database-mail

See Also

https://workbench.cisecurity.org/files/2837

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv6|18, CSCv7|9.2

Plugin: MS_SQLDB

Control ID: 53f9edac6ad6d3cdf0bc7e1690d4d0421016217ea7b8c39d5dd7f9c57aa70e0c