Domain: freetds.org
Stories and comments across the archive that link to freetds.org.
Comments · 13
-
Sybase and MS SQL Server Compatibility
"...the language is criticized for lack of a promised cross-platform function because of its ties to MS SQL server, which only runs on Windows..."
At one time Sybase and SQL Server used to be compatible. I would use MS SQL Server ODBC drivers to connect to Sybase running on *nix systems. I would also use the open source TDS software from http://www.freetds.org/ software to allow *nix machines to pull data from SQL Server running on Windows machines. Granted MS and Sybase seem to have forked the TDS protocol which both databases use.
-
This is NOT an IIS problemThe exploit in question has nothing to do with IIS, period, whatsoever. It's being targeted at servers that run IIS because those are the ones most likely to have SQL Server as their database back-end. Plenty of companies have deployed a Linux/Apache/PHP stack that talks to a SQL Server backend via FreeTDS, for example, and some of them will be getting hit by this, despite not running a single instance of IIS.
The query being used is exploiting features in Microsoft SQL Server, combined with a couple of external factors. Developers who have failed to check and sanitize user input, and DBAs who have not properly secured their databases. In order for your website to be owned through this attack:- You must be running Microsoft SQL Server as your database platform
- Your web application must be vulnerable to SQL injection
- The SQL Server user that your web application authenticates as must have SELECT and UPDATE access to the sysobjects table
If your web application can query dbo.sysobjects and get anything other than "Server: Msg 229, Level 14, State 5, Line 1" in response, it's time to hire an additional DBA. If your web application allows random queries to be passed into SQL Server in the first place, it's time to hire an additional developer. In either case, make "security" a bullet-point on the job posting. -
Re:I think this is great...
Yep - I can think of at least one legitimate use for me. Working for a large nameless and faceless corporation, they do content filtering on the firewall and sometimes some suprising things get blocked. The FreeTDS site was blocked for some dumb reason, for example. Being a UNIX system administrator, I do a lot of research on security and hacking methods (I wear a white hat, for sure) and frequently get blocked by the firewall because I'm looking up stuff on sites it labels as "hacking related". I mean, duh, the crackers and script kiddies can get to all the information about how to compromise my systems, but I can't see the same information to figure out how to safeguard them?
I could set up my own authenticated server on my home box (Ubuntu) and proxy through it for unfettered access. Granted there'd be a speed hit because of the upload limit on the cable box, but it'd be better than having to send myself notes to download stuff at home and bring it back to work the next day on my pen drive.
-
Re:Popularity
Ever hear of Sybase ASE? This is where Microsoft SQL Server originated from. Actually, back then, Sybase's database was known as SQL Server.
:-P
Although their versions of Transact SQL have forked (slightly), Sybase and Microsoft T-SQL is still roughly 98% compatible.
If your download FreeTDS from http://www.freetds.org/ and use that instead of the Microsft or Sybase libraries and download unixODBC you will be able to develop apps that'll run on most of the *nixes or Windows. And you can switch your DBMS from Sybase to Microsoft (and vice versa) with very little effort.
Anyhoo, FreeBSD does have a port of Sybase ASE 11.0.xxx which Sybase allows you to work with and last I heard, there were no licensing fees. -
Re:Java Java Java!
If you are stuck with MSSQL for your database backend then forget about anything but ASP.
Those who say something cannot be done should not interfere with those who are actually doing it.With the right JDBC driver, java talks to MSSQL just fine. Even java running on *nix has no problems working with a MSSQL database on Windows box. It just works, and lots of `large scale websites' use java and MSSQL together.
Personally, I run perl code on my Linux box that works on a MSSQL database. It works fine too, though I've been a little frustrated that FreeTDS doesn't support placeholders yet. (But this is a limitation of FreeTDS, not MSSQL. And apparantly you can work around it by using ODBC, which I'm not going to do. But either way, it does work fine.)
-
Will Sybase be unhappy about this ?I wonder if the folks at Sybase will be unhappy. SQLServer is basically a fork of the Sybase Adaptive Server Enterprise product.
I suppose the freetds folks could benefit from it, but SQLServer is probably patent encumbered, so perhaps they'll avoid looking ?
-
Re:For those of you who use Linux or Mac OS X...
> Why is this a troll?
Good question. I guess someone didn't like me and blew all their mod points. Just to tick them off I'll post it again. :-)
Subject: For those of you who use Linux or Mac OS X... ...make sure you pick up a cross-platform tool for working with SQL. SQL Server is particularily hard to use in a cross-platform way, but thanks to the jTDS and FreeTDS projects, we now have drivers.
Linux and Mac OS X users, unite! Or untie. Or something... -
For those of you who use Linux or Mac OS X...
...make sure you pick up a cross-platform tool for working with SQL. SQL Server is particularily hard to use in a cross-platform way, but thanks to the jTDS and FreeTDS projects, we now have drivers.
Linux and Mac OS X users, unite! Or untie. Or something... -
Re:Windows Compliant / Posix Compliant Drivers
Hrm. Is there really a sufficient market for this? I'd think that some of the work that the freetds folks have done would be relevant. (Of course, that's getting free clients to talk to MS SQL/Sybase servers, not the other way around)
-
FreeTDS
You can use FreeTDS to connect apache to SQL Server. Re-engineering your applications for another database, not to mention the database migration itself, is a lot of work to move to a less capable server. OTOH, converting to Apache will get you a better product that's cheaper and more secure.
http://www.freetds.org
-
Worm or Middleware?
Heck
I think if you look at it from an angle, you'd find out this might actually be a good thing. This piece of "innovation" might render the likes of FreeTDS simply obsolete.
Using a MS SQL Server from a Linux host has always been difficult, now you can simply use IRC to fire your sql statements and get your data! Information at your fingertips. Information at everyone's fingertips!
Dave -
Re:Communication between mySQL and ODBC
if you dont _have_ to use ODBC, you could go for a native connection (much faster too...)
have a look at www.freetds.org or Sybase's OpenClient (sorry no URL). -
Not J2EE; maybe freetds_jdbc
I think you're mistaking supported drivers for included drivers. However, freetds_jdbc is good enough for use with BRL, even though a lot of advanced JDBC features are lacking. It's in production use where I work.