MBSA Weak passwords report differ remote versus local scan
-
Thursday, June 28, 2012 1:57 PM
I've been an MBSA user for many years and during the last couple of months I've noticed a number of instances where MBSA 2.2 reported SQL user accounts with blank or simple passwords (remotely). The odd thing about it is that if you run the scan locally (MBSA 2.2 installed on the device) MBSA reports no SQL accounts with blank or simple passwords. I ran a password cracking utllity that runs through a combination of IDs/passwords and it was not able to sucessfully login using the password combinations listed in the help "how to correct this". My scanning machine is a windows 7 (x64), fully patched with Symantec SEP AV. At this point it appears that it is a false positive but, I am at a loss to explain why this issue has surfaced when in the past the test ran perfectly. Any ideas?
.png)
