CIA RESEARCH

Alerts

[CIA-1055-Alert] PostgreSQL Encoding Processes May Let Remote Users Inject SQL Commands

Summary:

Security issues were discovered in PHP related to the parsing of invalid multibyte character sequences, allowing SQL Injection under certain conditions.

Technical Details:

Version of Postgres do not properly validate user-supplied input, allowing a remote attacker to conduct SQL injection attacks by supplying invalid multi-byte characters. Versions prior to 8.1.4, 8.0.8, 7.4.13, and 7.3.15 are affected.

Another vulnerability relates to the use of slashes to escape ASCII characters when multibyte encodings are in use. When an application uses this escape sequence there are conditions when it is possible to perform SQL injection against the Postgres database.

Solution:

http://www.postgresql.org/docs/techdocs.50

CVE Reference:

CVE-2006-2313

CVE-2006-2314

SecurityTracker Number(s):

1016142

Vendor URL:

www.postgresql.org

About the Cenzic CIA Team:

Cenzic Intelligent Analysis (CIA) is Cenzic's research arm that focuses on continuous research for application vulnerabilities. Industry Research, Vulnerability assessment, penetration testing, and security testing - that's what Cenzic Intelligent Analysis Research is all about. Cenzic has dedicated experts whose sole job is to perform ongoing research to find not only common vulnerabilities but also vulnerabilities found in customer applications and make them available to our customers and to the community at large.

About Cenzic:

Cenzic provides Hailstorm® the revolutionary enterprise software suite for automated application security assessment and compliance that allows corporations and government organizations to dramatically improve the security of commercial and custom applications. Hailstorm enables security experts, QA professionals, and developers to work together to assess, analyze, and remediate applications for security vulnerabilities, and verify compliance with security policies. Benefits include reduced security risk and liability, lower development and testing costs, and faster time-to-market. Cenzic's customers are currently in the financial services and e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC