Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Full-disclosure] Security Advisory: CA CleverPath SQL Injection

from [Irene Abezgauz] Network Security [Permanent Link]
Subject: [Full-disclosure] Security Advisory: CA CleverPath SQL Injection
Date: Tue, 24 Apr 2007 20:00:49 +0300 
Background
==========
The CA Clever Path Portal is a customizable portal for aggregation and
integration of data and applications. It is integrated into multiple CA
products including various Unicenter components. The CA CleverPath
utilizes a back end Database for storing data and allows usage of either
built in or external Database.

Scope
=====
After identifying in CleverPath an irregular behavior when modifying
query parameters in the search mechanism, Hacktics has conducted a
research of identifying an SQL Injection vulnerability in the
implementation of the search query construction. 


The Finding
===========
By modifying certain parameters in the execute search URL, it was
possible to cause the  application to send to the database queries that
are different than those originally  intended by the search engine, and
as a result retrieving the entire database contents  according to the
application user permissions scheme in the database.

Note: Due to the diversity of possible Database implementations for
CleverPath, the actual level of possible exploitation may vary between
different systems.


Exploit Details
===============
Due to the complexity of the required syntax, the identified SQL
injection does not allow for trivial exploitation such as UNION SELECT.
However, data can be still retrieved using Binary Search techniques. 

For detailed technical description and exploit please visit
http://www.hacktics.com/AdvCleverPathApr07.html


Affected Systems
================
Multiple CA products and 3rd party products utilizing the CleverPath
Portal. 


Solution
========
CA Has been notified of this vulnerability on Januarty 18th, and is
releasing a patch together with the publication of the vulnerability.


-----------------------
Irene Abezgauz
Senior Consultant & Account Manager
Hacktics Ltd.
Mobile: +972-54-6545405
Web: http://www.hacktics.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [Full-disclosure] Security Advisory: CA CleverPath SQL Injection, Irene Abezgauz <=
Previous by Date:  [Full-disclosure] [ GLSA 200704-21 ] ClamAV: Multiple vulnerabilities, Matthias Geerdsen
Next by Date:  [Full-disclosure] [SECURITY] [DSA 1280-1] New aircrack-ng packages fix arbitrary code execution, Moritz Muehlenhoff
Previous by Thread:  [Full-disclosure] [ GLSA 200704-21 ] ClamAV: Multiple vulnerabilities, Matthias Geerdsen
Next by Thread:  [Full-disclosure] [SECURITY] [DSA 1280-1] New aircrack-ng packages fix arbitrary code execution, Moritz Muehlenhoff
Indexes:  [Date] [Thread] [Top] [All Lists]