[REVS] Buffer Truncation Abuse in Microsoft SQL Server Based Applications
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 3 Jul 2007 18:21:00 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
Buffer Truncation Abuse in Microsoft SQL Server Based Applications
This paper is designed to document an attack technique Sec-1 recently
adopted during the course of their application assessments. The basic
principal of this technique has existed for some time; however we hope
this paper we will provide an insight of how a variation of the technique
can be adopted to attack common forgotten password functionality within
The document is split into two sections. The first section covers the
principals of the technique and the second is an attack case study against
a commercial application (Removed in this release).
The problem described in this paper can be easily mitigated through secure
For example the following code amendments could be included to resolve the
The first step should be to validate the email address to only permit good
characters. Any violation of this filter should be logged for further
analysis. For further information on what constitutes good characters
within an email address see RFC28223 and the Wikipedia4 article.
Secure Variable Creation
Ensuring the .NET variable and Microsoft SQL server variable have the same
maximum length. In the case of the first example the following variable
declarations could be used:
Dim UserNameAsEmail AS String * 320
Declare @UserNameAsEmail varchar(320)
The information has been provided by <mailto:garyo@xxxxxxxxx> Gary
The original article can be found at:
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [UNIX] ImLib _LoadBMP Endless Loop (BPP, biBitCount)
- Next by Date: [UNIX] MySQLDumper Vulnerability: Bypassing Apache Based Access Control Possible
- Previous by thread: [UNIX] ImLib _LoadBMP Endless Loop (BPP, biBitCount)
- Next by thread: [UNIX] MySQLDumper Vulnerability: Bypassing Apache Based Access Control Possible