Sybmail Security

To prevent unauthorized users from accessing privileged Adaptive Server data through e-mail use the xp_sendmail or sp_processmail procedures to set the execution privileges on the ESPs that process mail and to set the security context for executing queries.

• Set Execution Privileges
  The ESPs that process mail, such as xp_findnextmsg, xp_readmail, xp_sendmail, and xp_deletemail, are database objects owned by the system administrator.
• Set the Execution Context
  When you use xp_sendmail to execute a query that has been submitted via an e-mail message, the query with the privileges of a particular Adaptive Server login in a particular database. This login/database combination is the execution context. By default, the login is “sybmail” and the database is master.