Latest MS SQL Server vulnerabilities revealed

[Cesar]

There are available to download, a new POC tool, paper
and presentation on the latest MS SQL Server bugs.


Hunting Flaws in Microsoft SQL Server Presentation

This presentation was delivered at the Black Hat 2003
Windows Security Conference, and illustrates many new
Microsoft SQL Server vulnerabilities. Improvements
that were made to Microsoft SQL Server in the new SP3
release to fix these vulnerabilities are also
discussed. Also, a new tool to exploit the SQL
Injection techniques described in the paper
Manipulating Microsoft SQL Server Using SQL Injection
was also introduced.

http://www.appsecinc.com/news/briefing.html#hunting


Hunting Flaws in Microsoft SQL Server White Paper

This paper illustrates many new Microsoft SQL Server
vulnerabilities and how they were found. It explores
many of the issues discussed in its counterpart
presentation.

http://www.appsecinc.com/news/briefing.html#hunting2


Data Thief

Data Thief is a “proof-on-concept” tool used to
demonstrate to web administrators and developers how
easy it is to steal data from a web application that
is vulnerable to SQL Injection. Data Thief is designed
to retrieve the data from a Microsoft SQL Server
back-end behind a web application with a SQL Injection
vulnerability. Once a SQL Injection vulnerability is
identified, Data Thief does all the work of listing
the linked severs, laying out the database schema, and
actually selecting the data from a table in the
application.

http://www.appsecinc.com/resources/freetools/

Feedback is welcome.

NEW SECURITY LIST: For people interested in SQL Server
security, vulnerabilities, SQL injection, etc., I'm
starting a new mailing list you can join at:

http://groups.yahoo.com/group/sqlserversecurity/

Enjoy!!

Cesar


__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com

[Jeff Moss]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cesar and Bugtraq,

If anyone is interested in watching Cesar's talk from Black Hat
Windows, I
just put it on-line. It is not linked directly from the web site yet,
but
can be found here:

rtsp://media.blackhat.com/blackhat/bh-usa-win-03/video/BH-WIN-2003-CER
RUDO-NEWMAN.rm

Jeff

At 03:49 PM 4/29/2003 -0700, Cesar wrote:

>There are available to download, a new POC tool, paper
>and presentation on the latest MS SQL Server bugs.
>
>
>Hunting Flaws in Microsoft SQL Server Presentation
>
>This presentation was delivered at the Black Hat 2003
>Windows Security Conference, and illustrates many new
>Microsoft SQL Server vulnerabilities. Improvements
>that were made to Microsoft SQL Server in the new SP3
>release to fix these vulnerabilities are also
>discussed. Also, a new tool to exploit the SQL
>Injection techniques described in the paper
>Manipulating Microsoft SQL Server Using SQL Injection
>was also introduced.
>
>http://www.appsecinc.com/news/briefing.html#hunting

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
Comment: Please Verify Key IDs & Fingerprints

iQA/AwUBPq9i1FqBFadmyozQEQIVVwCgxEpnjguie9INP7hVZkYbnZ DC94cAn3hM
HOgzW79aoc2MmZHt0fdtLQ4H
=AAYH
-----END PGP SIGNATURE-----

[Michael -]

After reading your papers I must say it was quite interesting and it introduce quite a few new ideas. However, most of them (at leat in your paper found at http://www.appsecinc.com/presentations/Manipulating_SQL_Server_Using_SQL_Injection.pdf ) base them
selves on the idea that you can perform an 'insert' with SQL injection. In my experience, this is impossible most of the time due to the fact that MSSQL doesnt allow multiple statement and that you can only add an union in the middle of an SQL statement t
hat is usualy part of a web application.

Michael

[Cesar]

MS SQL Server DOES allow multiple statements, you
should be confused with mysql. The ideas presented in
paper work most of the time on web applications
vulnerable to SQL injection, the only problem is when
firewalls block all outbound connections, but that can
be bypassed using other OLEDB providers.

Cesar.

--- Michael - <michael@nix.org> wrote:
>
> After reading your papers I must say it was quite
> interesting and it introduce quite a few new ideas.
> However, most of them (at leat in your paper found
> at
>
http://www.appsecinc.com/presentations/Manipulating_SQL_Server_Using_SQL_Injection.pdf
> ) base themselves on the idea that you can perform
> an 'insert' with SQL injection. In my experience,
> this is impossible most of the time due to the fact
> that MSSQL doesnt allow multiple statement and that
> you can only add an union in the middle of an SQL
> statement that is usualy part of a web application.
>
> Michael
>


__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com