sql server full text search: Turning off signature verification on word breakers -- sql server full text search

You're in the

sql server full text search

group:

Turning off signature verification on word breakers

InstantKiwi
9/6/2007 10:23:01 PM

sql server full text search:

Howdy folks,

Some of you may have experience the issue described in the following
MS kb article, "You may experience a 45-second delay when you run a
full-text query in an instance of SQL Server 2005 that is running on a
server without Internet access" (http://support.microsoft.com/kb/
915850).

Does anybody know what the risks are of implementing the suggested
work around which is to turn off signature verification on word breaks
(e.g. - sp_fulltext_service 'verify_signature', 0). The article
says...

"Warning If you ignore signature verification, the instance of SQL
Server 2005 is less secure. We recommend that you sign any word breaks
that you install or make sure that any word breakers that you acquire
are signed."

What types of vulnerabilities I am exposing my SQL Server to if I turn
off signature verification.

Thanks in advance.
Kahu

Re: Turning off signature verification on word breakers

Hilary Cotter
9/7/2007 6:53:31 AM

Hi Kiwi - I used to live in New Plymouth.

At some point in time in the future there might be an exploit which uses one
of the third party ifilters. Should a malicious hacker replace an unsigned
ifilter with one of their own they might be able to gain access to your
system (although they already have enough access to replace the dll so they
pretty well own your machine anyway).

To protect against this you can check to ensure that all your ifilters are
signed.

--
RelevantNoise.com - dedicated to mining blogs for business intelligence.

Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html

Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
[quoted text, click to view]

Re: Turning off signature verification on word breakers

InstantKiwi
9/10/2007 4:09:19 PM

Ahhh, the mighty Taranaki.

It's in the laps of the gods (ops team) now. My temporary work around
until a decision is made was to create a SQL Agent job that executes a
simple SELECT COUNT(0) FROM Blah WHERE FREETEXT(Description, 'blah')
every 4 minutes.

Thanks again,
Kahu

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the sql server full text search group.

View Other Months
June 2003
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007

home · blog · groups

Questions? Comments? Contact the dn