bugtraq - Re: SQL Smuggling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 10 Sep 2008 13:03:24 +0200 (ora solare Europa occidentale)
From: Marco Ivaldi <raptor@...iaservice.net>
To: bugtraq@...urityfocus.com
Subject: Re: SQL Smuggling

Avi,

On Tue, 9 Sep 2008, douglen@...mail.com wrote:

[snip]

> Of course, I'm looking forward to hearing about other instances of 
> this...

Interesting reasearch.

It looks like Oracle DBMS may be vulnerable to the "Unicode Smuggling" 
attack exploiting homoglyphic translation. As outlined by David Litchfield 
in an old full-disclosure post [1]:

"It didn't take long to discover that this patch could be bypassed using 
the following techinque: due to internationalization, an Oracle database 
server will convert the ? character (value 0xFF) to a capital Y. The PLSQL 
Gateway will not. Thus, if we request:

http://www.example.com/pls/dad/S%FFS.PACKAGE.PROCEDURE

the gateway will happily pass it over to the database server where the ? 
is conveted to a Y and we can gain access again".

Cheers,

[1]. See http://seclists.org/fulldisclosure/2006/Feb/0011.html

-- 
Marco Ivaldi, OPST
Red Team Coordinator      Data Security Division
@ Mediaservice.net Srl    http://mediaservice.net/