Using the Database To Do Too Much - Implementing Database Security and Auditing - page 209

xp_createprivatequeue
xp_createqueue
xp_decodequeuecmd
xp_deleteprivatequeue
xp_deletequeue
xp_displayqueuemesgs
xp_dsninfo
xp_mergelineages
xp_oledbinfo
xp_proxiedmetadata
xp_readpkfromqueue
xp_readpkfromvarbin
xp_repl_encrypt
xp_resetqueue
xp_sqlinventory
xp_unpackcab
The patch for this shared vulnerability is available at
www.microsoft.com/technet/security/bulletin/MS00-092.mspx. The patch
works by changing all default extended procedures to allocate a correctly
sized buffer before calling srv_paraminfo .
In order to lessen your liability, you should make sure your system is
patched with fixes to these vulnerabilities, and you should make sure you
either remove these from your system altogether or at least provide access to
them only to privileged accounts. You should also track their usage by mon-
itoring all calls to these procedures. If you are unsure whether these proce-
dures are being used (and thus are worried that removing or changing their
privileges may affect an application), you should trace their usage for a
period of one to four weeks and then take action. If you find that an appli-
cation is using these procedures, you should bring the topic to the attention
of the application owner and try to work a schedule for rewriting the code
using these procedures so that you may disable them.
If they are not used simply remove them. To remove an extended proce-
dure (e.g., xp_regread ), use the following command:
exec sp_dropextendedproc 'xp_regread'