2.4 Ensure 'Database Mail XPs' Server Configuration Option is set to '0'

Information

The Database Mail XPs option controls the ability to generate and transmit email messages from SQL Server.

Rationale:

Disabling the Database Mail XPs option reduces the SQL Server surface, eliminates a DOS attack vector and channel to exfiltrate data from the database server to a remote host.

Solution

Run the following T-SQL command:

EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'Database Mail XPs', 0;
RECONFIGURE;
GO
EXECUTE sp_configure 'show advanced options', 0;
RECONFIGURE;

Default Value:

By default, this option is disabled (0).

See Also

https://workbench.cisecurity.org/files/2945

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv6|18, CSCv7|9.2

Plugin: MS_SQLDB

Control ID: cc69710796c30bc79b88b06af8676517e9f6f548c2c85eff368ad8fe4c981b8a