View Single Post
Old 04-25-2008, 12:10 PM Offline   #1 (permalink)

coolmanhiphop


 
coolmanhiphop's Avatar
Mr. News Guy
 
Since: Nov 2007
Posts: 109,399
Rank:
Uploads: 0
eCash: $500
Thank Meter: 9973

coolmanhiphop started pushin nickels an dimescoolmanhiphop started pushin nickels an dimescoolmanhiphop started pushin nickels an dimescoolmanhiphop started pushin nickels an dimescoolmanhiphop started pushin nickels an dimescoolmanhiphop started pushin nickels an dimescoolmanhiphop started pushin nickels an dimescoolmanhiphop started pushin nickels an dimescoolmanhiphop started pushin nickels an dimescoolmanhiphop started pushin nickels an dimescoolmanhiphop started pushin nickels an dimes
Rep Power: 2076
Default New Attack Exploits "Safe" Oracle Inputs

Trailrunner7 writes "Database security super-genius David Litchfield has found a way to manipulate common Oracle data types, which were not thought to be exploitable, and inject arbitrary SQL commands. The new method shows that you can no longer assume any data types are safe from attacker input, regardless of their location or function. Litchfield wrote, "In conclusion, even those functions and procedures that don't take user input can be exploited if SYSDATE is used. The lesson here is always, always validate and prevent this type of vulnerability getting into your code. The second lesson is that no longer should DATE or NUMBER data types be considered as safe and not useful as injection vectors: as this paper[PDF] has proved, they are," he writes."
Read more of this story at Slashdot.
</img>


More...
  Reply With Quote