SQL Injection

 database security

SQL Injection

Description

In 2003, an analysis of the buffer overflow exploit caused it to be pronounced the vulnerability of the decade (Cowan et al., 2003).  Since that time, buffer overflow exploits have ranked in the top ten exploits of the Open Web Application Security Project (OWASP), National Vulnerability Database, and Common Weakness Enumeration / SANS list of Top 25 Most Dangerous Software Errors.

SQL injection is a code injection technique that can be used against MS SQL, MySQL, as well as other DBMSs. A buffer is a region of memory that temporarily holds data.  In a buffer overflow attack, a malicious program injects too much data into the buffer. This can cause errors, program crashes, and security breaches.

 Buffer overflow occurs when a program or process tries to store more data in a buffer than it was intended to hold. The program execution will cause the application to write beyond the finite constraints of a pre-allocated size buffer. The overflowing data will overwrite adjacent memory locations and may corrupt the valid data held in them, or execute new instructions on the affected computer that could, damage user files, change data, or disclose confidential information.

Mitigation. Due to the fact that buffer overflow exploit a vulnerability occurring in at the database layer of an application, a simple mitigation is to not allow unauthorized user-input to be  directly embedded into SQL statements.

Another mitigation strategy is to use a programming language that performs its own memory management, such as Java and Perl, or an environment like .NET which may diminish the impact of buffer overflows. Additionally, Cyclone C may be used to negate buffer overflows, and other related exploits. Other languages such as, C#, and Ada, which supports run-time checks to protect against access to unallocated memory, buffer overflow errors, range violations, and other bugs may also be used. Both programs will allow the checking functionality to be disabled by the programmer if need be, to enhance performance.

We should assume all user-input is malicious, thus use a whitelist of acceptable inputs that adheres to specifications. The use of blacklists or looking solely for malformed input cannot be depended upon, though blacklists may be used as a yardstick for attack detection.

It is also advised that we run our DBMS in a sandbox, and that we set boundaries between processes and the operating system. Additionally, we should run our DBMS with the lowest level of privileges necessary to perform our functions.

We may also consider using Data Execution Prevention (DEP)/ NX memory protection. This is common security feature included in, Windows, Linux, and Mac operating systems. Its function is to prevent services and applications from implementing code in a non-executable memory region, thus preventing exploits that store code via a buffer overflow.

References

Cowan, C. (2003). “Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade.

OWASP Top 10. (2010) The Top 10 Most Critical Web Application Security Risks.