‘Buffer Truncation Abuse in Microsoft SQL Server Based Applications’

Summary

‘This paper is designed to document an attack technique Sec-1 recently adopted during the course of their application assessments. The basic principal of this technique has existed for some time; however we hope this paper we will provide an insight of how a variation of the technique can be adopted to attack common forgotten password functionality within web applications.

The document is split into two sections. The first section covers the principals of the technique and the second is an attack case study against a commercial application (Removed in this release).’

Credit:

‘The information has been provided by Gary Oleary-Steele.
The original article can be found at: http://www.sec-1labs.co.uk/papers/BTA_CensoredRelease.pdf


Details

Mitigation:
The problem described in this paper can be easily mitigated through secure development practices.

For example the following code amendments could be included to resolve the vulnerability.

Input validation
The first step should be to validate the email address to only permit good characters. Any violation of this filter should be logged for further analysis. For further information on what constitutes good characters within an email address see RFC28223 and the Wikipedia4 article.

Secure Variable Creation
Ensuring the .NET variable and Microsoft SQL server variable have the same maximum length. In the case of the first example the following variable declarations could be used:
Dim UserNameAsEmail AS String * 320
Declare @UserNameAsEmail varchar(320)

Categories: Reviews