[REVS] Buffer Truncation Abuse in Microsoft SQL Server Based Applications

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Buffer Truncation Abuse in Microsoft SQL Server Based Applications
------------------------------------------------------------------------

SUMMARY

This paper is designed to document an attack technique Sec-1 recently
adopted during the course of their application assessments. The basic
principal of this technique has existed for some time; however we hope
this paper we will provide an insight of how a variation of the technique
can be adopted to attack common forgotten password functionality within
web applications.

The document is split into two sections. The first section covers the
principals of the technique and the second is an attack case study against
a commercial application (Removed in this release).

DETAILS

Mitigation:
The problem described in this paper can be easily mitigated through secure
development practices.

For example the following code amendments could be included to resolve the
vulnerability.

Input validation
The first step should be to validate the email address to only permit good
characters. Any violation of this filter should be logged for further
analysis. For further information on what constitutes good characters
within an email address see RFC28223 and the Wikipedia4 article.

Secure Variable Creation
Ensuring the .NET variable and Microsoft SQL server variable have the same
maximum length. In the case of the first example the following variable
declarations could be used:
Dim UserNameAsEmail AS String * 320
Declare @UserNameAsEmail varchar(320)

ADDITIONAL INFORMATION

The information has been provided by <mailto:garyo@sec-1.com> Gary
Oleary-Steele.
The original article can be found at:
<http://www.sec-1labs.co.uk/papers/BTA_CensoredRelease.pdf>

http://www.sec-1labs.co.uk/papers/BTA_CensoredRelease.pdf

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.