bugtraq - Re: Bypassing Oracle dbms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <00a601c6b251$07ccb870$ab817818@ngssoftware.com>
Date: Fri, 28 Jul 2006 15:20:50 +0100
From: "David Litchfield" <davidl@...software.com>
To: <ak@...-database-security.com>, <bugtraq@...urityfocus.com>
Subject: Re: Bypassing Oracle dbms_assert

> I never claimed that dbms_assert is insecure nor do I recommend using
> dbms_assert in this (insecure) way with three consecutive quotes. My 
> PL/SQL
> samples show only the generic concept of bypassing dbms_assert.

Sorry to be pedantic but this is not a generic way (concept) of bypassing 
dbms_assert. Your method works only in those cases where the developer has 
misunderstood how to use DBMS_ASSERT and used the incorrect function. That's 
not a generic bypass technique for DBMS_ASSERT, imho. What you've found are 
simply flaws in the way the developer has attempted to sanitize user input. 
A generic bypass techinque for DBMS_ASSERT would work in all cases - even 
where the package is being used correctly. For example, passing the name of 
a VIEW as a parameter which calls nefarious functions could be employed as a 
bypass technique - but even this has its problems.
Cheers,
David