He that is without sin among you, let him first cast a stone at her

9 Jul 2007 von Alexander Kornbrust.

On Tom Kyte’s blog , Pete Finnigan’s blog and Sven Vetter’s blog there are comments about SQL Injection in a bank application.

I know that SQL Injection is a big problem and especially the vulnerability in this banking application was really severe. But in the real world most developers write (or at least wrote) unsecure code. Often they use (unsecure) samples from books. But who is writing the books?
Why do you blame this poor little bank. Don’t throw the first stone…
Let’s do some quick check how secure the code from other people or companies (e.g. intelligence agencies) is…
—-

Expert One-on-One by Tom Kyte from 2001. 2 years after SQL Injection became public.
p. 707:
create or replace
function update_row (p_owner in varchar2, p_newDname in varchar2, p_newLoc in varchar2, p_deptno in varchar2, p_rowid out varchar2)
return number
is
l_theCursor integer;
l_columnvalue number default NULL;
l_status integer;
l_update long;
begin
l_update := ‘update ‘ || p_owner || ‘.dept
set dname = :bv1, loc = :bv2
where deptno = to_number(:pk)
returning rowid into :out’;
l_theCursor := dbms_sql.open_cursor;
More code with SQL Injection (not complete I just skimmed through the book):

p710: execute immediate ’select count(*) from ‘||p_tname’
p710: execute immediate ‘update ‘||p_owner||’.dept…’

p712, p724, p726, p727, p728, p729, 1087. I stopped her…
—-
Oracle Database 10g - The complete reference by Kevin Loney

page 577

—

Oracle Security in der Praxis by Frank Haas (German Oracle Security Book from a nice and clever Oracle Consultant)

page 139, 140

—

Effective Oracle Database 10g Security by design by David C. Knox

page 30

—

Database Security Technical Implementation Guide STIG V7.2, by the DISA (Defense Information Systems Agency responsible for DOD systems)
page 186 plus some more
—

Trivadis.com

PDF-file DBMS_SYS_SQL..PARSE_AS_USER:

page 1,2,4

—

Will be continued…

Geschrieben in SQL Injection, source code audit, Oracle Security | Drucken | 2 Kommentare »