From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 18 May 2005 15:27:24 +0200
Subject: [REVS] SQLBlock: SQL Injection Protection by Variable Normalization of SQL Statement
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20050518123128.599E65D1F@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
SQLBlock: SQL Injection Protection by Variable Normalization of SQL
Statement
------------------------------------------------------------------------
SUMMARY
The article linked at this advisory presents a method to protect from SQL
injection attack. The method involves using a virtual database
connectivity drive as well as a special method named variable
normalization to extract the basic structure of a SQL statement so that we
could use that information to determine if a SQL statement is allowed to
be executed. The method can be used in most scenarios and does not require
changing the source code of database applications (i.e. the CGI web
application). The presented method can also be used for auto-learning the
allowable list of SQL statements, which makes the system very easy to
setup. And since the decision of whether a SQL statement is allowed is to
check if the normalized statement exists in our ready-sorted allowable
list, the overhead of the system is very minimal.
DETAILS
Conclusion:
We presented variable normalization for SQL statements, which can
extract the basic structure of a SQL statement. If SQL injection happens,
the structure of the SQL statement will be altered and hence normalized
SQL statement will also be altered and we will be able to detect it. We
use this method to implement SQLBlock, a database connectivity layer proxy
driver that can block SQL injection attacks.
SQLBlock has very minimal overall performance impact. Theoretically, it
works will all database servers without the need to change the client
source code. Auto-learning the allowable list makes the system easy to
deploy even for complex clients that will issue many different SQL
commands. And since SQLBlock is a connectivity layer proxy, it works even
for SSL web applications. We believe SQLBlock is an effective and
practical solution to solve this class of attacks.
ADDITIONAL INFORMATION
The information has been provided by <mailto:samng@computer.org.> Sam M.S.
NG.
The original article can be found at:
<http://www.sqlblock.com/sqlblock.pdf>;
http://www.sqlblock.com/sqlblock.pdf
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
