| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 9 May 2006 19:47:48 -0400 From: "Brian Gallagher" <brian@...mondsea.com> To: bugtraq@...urityfocus.com Subject: Multiple SQL Injection Vulnerabilities in Dreamweaver Generated Code Multiple SQL Injection Vulnerabilities in Dreamweaver Generated Code INFORMATION: ------------------------- Class: SQL Injection CVE: CVE-2006-2042 Remote: Yes Local: Yes Published: May 09, 2006 Credit: Brian Gallagher <brian@...mondsea.com> Vulnerable: Dreamweaver Ultradev Dreamweaver MX Dreamweaver MX 2004 Dreamweaver 8 (fixed in version 8.0.2) DISCUSSION ------------------------- There are multiple SQL Injection vulnerabilities in the code generated by Adobe's Macromedia Dreamweaver prior to versino 8.0.2. This vulnerability affects the ColdFusion, PHP mySQL, ASP, ASP.NET and JSP server models. If the database server is configured to allow local system commands to be executed via database calls, this vulnerability may also allow local code execution. Dreamweaver offers powerful rapid-application design (RAD) tools for quickly and easily creating Internet and Intranet applications for a variety of server models (databases and languages). The code generated automatically by these functions does not properly validate input and are vulnerable to SQL Injection attacks from remote users. Macromedia (now Adobe) was notified of the problem in October 2005. They have been working cooperatively to remedy this problem, including examining and updating all their server models. If all vendors were this cooperative and responsive, the digital world would be a safer and better place. Adobe today released the updated version of Dreamweaver 8.0.2 (free download) along with instructions on how to workaround the problem in code developed in earlier versions of Dreamweaver. The Adobe announcement can be found here: http://www.adobe.com/support/security/bulletins/apsb06-07.html EXPLOIT ------------------------- This vulnerability can be exploited by standard SQL injection techniques. The documentation supplied by Adobe in their release details where the vulnerabilities exist and how to correct them. If a web server's database allows access to the system commands through SQL queries local command execution is possible. SOLUTION ------------------------- Dreamweaver 8: Install the free updater to version 8.0.2 and recreate your server components to use the new more secure code. Dreamweaver MX 2004: Follow the directions for your server model on how to secure your existing code. Dreamweaver MX, Ultradev: Read the directions for the MX 2004 fixes and adapt these to your code. REFERENCES ------------------------- Macromedia Security Bulletin: Dreamweaver Server Behavior SQL Injection vulnerability http://www.adobe.com/support/security/bulletins/apsb06-07.html Dreamweaver Support Center: Updaters http://www.adobe.com/support/dreamweaver/downloads_updaters.html Protecting ColdFusion server behaviors from SQL injection vulnerability http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=300b670e Protecting PHP server behaviors from SQL injection vulnerability http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=30037473 Protecting ASP VBScript server behaviors from SQL injection vulnerability http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=57ae79b2 Protecting ASP JavaScript server behaviors from SQL injection vulnerability http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=581a553c Protecting JSP server behaviors from SQL injection vulnerability http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=585ac720 -- Brian Gallagher - DiamondSea.com - brian@...mondsea.com We Make E-Commerce Easy - No Technical Experience Required Consulting - E-Commerce - Web Site Design - Custom Programming http://www.DiamondSea.com - Toll-Free: 800-604-1476 - Fax: 888-411-8144
Powered by blists - more mailing lists