[REVS] Buffer Truncation Abuse in Microsoft SQL Server Based Applications



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Buffer Truncation Abuse in Microsoft SQL Server Based Applications
------------------------------------------------------------------------


SUMMARY

This paper is designed to document an attack technique Sec-1 recently
adopted during the course of their application assessments. The basic
principal of this technique has existed for some time; however we hope
this paper we will provide an insight of how a variation of the technique
can be adopted to attack common forgotten password functionality within
web applications.

The document is split into two sections. The first section covers the
principals of the technique and the second is an attack case study against
a commercial application (Removed in this release).

DETAILS

Mitigation:
The problem described in this paper can be easily mitigated through secure
development practices.

For example the following code amendments could be included to resolve the
vulnerability.

Input validation
The first step should be to validate the email address to only permit good
characters. Any violation of this filter should be logged for further
analysis. For further information on what constitutes good characters
within an email address see RFC28223 and the Wikipedia4 article.

Secure Variable Creation
Ensuring the .NET variable and Microsoft SQL server variable have the same
maximum length. In the case of the first example the following variable
declarations could be used:
Dim UserNameAsEmail AS String * 320
Declare @UserNameAsEmail varchar(320)


ADDITIONAL INFORMATION

The information has been provided by <mailto:garyo@xxxxxxxxx> Gary
Oleary-Steele.
The original article can be found at:
<http://www.sec-1labs.co.uk/papers/BTA_CensoredRelease.pdf>
http://www.sec-1labs.co.uk/papers/BTA_CensoredRelease.pdf



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [REVS] Exploiting Windows Device Drivers
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... attack was presented by SEC-LABS team in the "Win32 Device Drivers ... driver exploitation technique will be introduced, ... experience with software vulnerability exploitation. ...
    (Securiteam)
  • [NT] NTFS Data Stream Malware Stealth Technique
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... NTFS Data Stream Malware Stealth Technique ... C:\>echo I'm an inocent file. ...
    (Securiteam)
  • [REVS] DNS Cache Snooping
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Linked below is a research paper discussing several aspects of DNS Cache ... Then this relatively unknown technique is introduced, ... a set of devised abuse scenarios that rely on cache snooping are ...
    (Securiteam)
  • [REVS] Understanding and Preventing DNS-related Attacks by Phishers
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... This paper, extending the original material of "The Phishing Guide", ... Internet-based customers are dependent upon, and how they can be exploited ... This paper focuses upon a recent group of attack vectors used by criminals ...
    (Securiteam)
  • [NT] Microsoft Outlook Web Access XSS (MS08-039)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Web Access (OWA) 2003/2007. ... Exchange Server 2007, Exchange Server 2007 SP1) ... An attacker can craft a malicious email which contains the attack strings ...
    (Securiteam)