lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 24 Apr 2007 20:00:49 +0300 From: "Irene Abezgauz" <irene@...ktics.com> To: <full-disclosure@...ts.grok.org.uk> Subject: Security Advisory: CA CleverPath SQL Injection Background ========== The CA Clever Path Portal is a customizable portal for aggregation and integration of data and applications. It is integrated into multiple CA products including various Unicenter components. The CA CleverPath utilizes a back end Database for storing data and allows usage of either built in or external Database. Scope ===== After identifying in CleverPath an irregular behavior when modifying query parameters in the search mechanism, Hacktics has conducted a research of identifying an SQL Injection vulnerability in the implementation of the search query construction. The Finding =========== By modifying certain parameters in the execute search URL, it was possible to cause the application to send to the database queries that are different than those originally intended by the search engine, and as a result retrieving the entire database contents according to the application user permissions scheme in the database. Note: Due to the diversity of possible Database implementations for CleverPath, the actual level of possible exploitation may vary between different systems. Exploit Details =============== Due to the complexity of the required syntax, the identified SQL injection does not allow for trivial exploitation such as UNION SELECT. However, data can be still retrieved using Binary Search techniques. For detailed technical description and exploit please visit http://www.hacktics.com/AdvCleverPathApr07.html Affected Systems ================ Multiple CA products and 3rd party products utilizing the CleverPath Portal. Solution ======== CA Has been notified of this vulnerability on Januarty 18th, and is releasing a patch together with the publication of the vulnerability. ----------------------- Irene Abezgauz Senior Consultant & Account Manager Hacktics Ltd. Mobile: +972-54-6545405 Web: http://www.hacktics.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists