Search...

ms.odbc.coldfusion.txt

1999-08-17T00:00:00

ID PACKETSTORM:11803
Type packetstorm
Reporter Packet Storm
Modified 1999-08-17T00:00:00

Description

                                            `Date: Tue, 1 Jun 1999 11:45:35 -0700  
From: aleph1@UNDERGROUND.ORG  
To: BUGTRAQ@netspace.org  
Subject: New Allaire Security Bulletin (ASB99-09)  

Dear Allaire Customer --  

We have recently become aware of a serious security vulnerability that may affect  
customers using Microsoft Access with ColdFusion. This issue is not a problem with  
ColdFusion, but can occur when using some versions of the Microsoft Access ODBC driver.  

We have created a new Allaire Security Bulletin that documents this issue and the steps  
that customers can take to protect themselves. If you are using Microsoft Access with  
your Web applications we strongly recommend that you review this new bulletin:  

ASB99-09: Solutions to Issues that Allow Users to Execute Commands through  
Microsoft Access  

You can find this new bulletin and information about other security issues in the  
Allaire Security Zone:  

http://www.allaire.com/security  

As a Web application platform vendor, one of our highest concerns is the security  
of the systems our customers deploy. We understand how important security is to  
our customers, and we're committed to providing the technology and information customers  
need to build secure Web applications. Allaire has set up an email address that customers  
can use to report security issues associated with an Allaire product: secure@allaire.com.  

Thank you for your time and consideration on this issue.  

-- Allaire Security Response Team  

----------------------------------------------------------------------------------------  

&lt;http://www.allaire.com/handlers/index.cfm?ID=11069&Method=Full&gt;  

Allaire Security Bulletin (ASB99-09)  

Solutions to Issues that Allow Users to Execute Commands through Microsoft Access   

Originally Posted: June 1, 1999   
Last Updated: June 1, 1999   

Summary   
Some Microsoft ODBC drivers for Microsoft Access may allow users to execute Visual Basic  
for Applications (VBA) commands on the hosted server without permission. URL, form and  
cookie variables in a dynamic query in many development environments (e.g. ColdFusion, ASP,  
CGI, etc.) can be used to exploit this hole appending malicious VBA statements to existing  
queries. This problem can be easily fixed by upgrading to the Microsoft ODBC driver for Access  
included in MDAC 2.1 sp1a, available from Microsoft. In general, Allaire recommends that  
customers use proper coding methods for validating dynamic query variables passed on URL  
strings, http forms or cookies. This is not a security issue with ColdFusion itself. However,  
ColdFusion customers using Access are vulnerable to this issue. (This issue is similar to the  
vulnerabilities documented in ASB99-04, which are associated with appending malicious SQL  
statements to query strings sent to some enterprise databases.)   

Issue   
In a Web application there are often circumstances where queries are built dynamically using  
variables that are passed on URLs or in forms. Some versions of the Microsoft Access ODBC  
driver support the ability to append VBA commands to a SQL string. As a result, a malicious  
attack could be made by using URL, form or cookie variables to send VBA commands through a  
query. These VBA commands could potentially be used to damage the server or to gain  
unauthorized access to information and systems. (The potential for a similar problem using SQL  
statements and some enterprise database was documented in ASB99-04).   

Some versions of the Microsoft Access ODBC driver allow for appending VBA commands to a  
SQL string. The VBA commands are appended by using the pipe character, or Chr(124), which  
is treated as a reserved character by the Access ODBC driver. See the following MS  
Knowledge Base article for details:   
http://support.microsoft.com/support/kb/articles/q147/6/87.asp   

This reserved character allows users to modify a URL, form or cookie variable to execute VBA  
commands against the Web server using the ODBC driver. The following string is an example  
of one that can be used to initiate an attack by writing a file to the web servers hard drive:   

'|shell("cmd /c 1 &gt; c:\temp\foo.txt")|'  

This string could be passed to an application using a URL variable, so the page could be called  
as follows:   

http://myserver/page.cfm?x='|shell("cmd /c 1 &gt; c:\temp\foo.txt")|'  

This code, when executed as part of the following dynamically created query, will cause a file to  
be created at the location c:\temp\foo.txt.   

&lt;CFQUERY name="getUsers2" DATASOURCE="test1"&gt;  
SELECT *   
FROM USERS  
WHERE lname = '#URL.X#'  
&lt;/CFQUERY&gt;  

This code could also be vulnerable when processing form input from a template using a form  
variable called 'X'. Please note that you should always validate user-initiated input, including  
URL, form, and cookie variables.   

Affected Software Versions   

ColdFusion Server (all versions and editions) running with Microsoft Access through  
ODBC   

What Allaire is Doing   
This issue is not a problem with ColdFusion, but can occur when using Microsoft Access and  
some versions for the Access ODBC driver. It is not a problem with ColdFusion, but it can  
affect ColdFusion applications that use Access. To respond to this issue, Allaire has published  
an Allaire Security Bulletin (ASB99-09) notifying customers of the problem and remedies that  
can be used to address it. We have sent a notification of the bulletin to customers who have  
subscribed to Allaire Security Notifications.   

What Customers Should Do   
This issue appears to be fixed by the installation of the Microsoft Access ODBC driver included  
with MDAC 2.1 sp1a. We strongly recommend that customers install this ODBC driver. It  
should not adversely affect the functionality of ColdFusion applications using Access. This  
MDAC can be downloaded from the Microsoft site:   

http://download.microsoft.com/msdownload/mdac/sp1a/x86/en/mdac_typ.exe   

In addition, Allaire recommends that customers write their code to validate variables that are  
passed into SQL statements, configure their database security properly, and use standard  
database application development practices such as stored procedures where appropriate to  
protect themselves. These are general requirements of production applications regardless of the  
development platform.   

There are many ways to address the issues raised by the risk of malicious SQL statements being  
inserted into dynamic queries. The Allaire Technical Brief  Securing Databases for ColdFusion  
Applications, details some of the steps you can take to secure your databases.   

It is important to note that each individual application may require its own particular steps in  
both coding and database configuration in order to be fully secured. Some of the techniques  
for securing database applications built with ColdFusion are detailed in the Allaire Technical Brief  
- Securing Databases for ColdFusion Applications.   

Revisions   
June 1, 1999 -- Bulletin first released.   

Reporting Security Issues   
Allaire is committed to addressing security issues and providing customers with the information  
on how they can protect themselves. If you identify what you believe may be a security issue  
with an Allaire product, please send an email to secure@allaire.com. We will work to  
appropriately address and communicate the issue.   

Receiving Security Bulletins   
When Allaire becomes aware of a security issue that we believe significantly affects our products  
or customers, we will notify customers when appropriate. Typically this notification will be in the  
form of a security bulletin explaining the issue and the response. Allaire customers who would  
like to receive notification of new security bulletins when they are released can sign up for our  
security notification service.   

For additional information on security issues at Allaire, please visit:  
http://www.allaire.com/security   

THE INFORMATION PROVIDED BY ALLAIRE IN THIS BULLETIN IS PROVIDED "AS IS"  
WITHOUT WARRANTY OF ANY KIND. ALLAIRE DISCLAIMS ALL WARRANTIES, EITHER  
EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND  
FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL ALLAIRE CORPORATION  
OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT,  
INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL  
DAMAGES, EVEN IF ALLAIRE CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED  
OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE  
EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL  
DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.   
`

JSON Vulners Source

Initial Source

{"sourceHref": "https://packetstormsecurity.com/files/download/11803/ms.odbc.coldfusion.txt", "sourceData": "`Date: Tue, 1 Jun 1999 11:45:35 -0700 \nFrom: aleph1@UNDERGROUND.ORG \nTo: BUGTRAQ@netspace.org \nSubject: New Allaire Security Bulletin (ASB99-09) \n \nDear Allaire Customer -- \n \nWe have recently become aware of a serious security vulnerability that may affect \ncustomers using Microsoft Access with ColdFusion. This issue is not a problem with \nColdFusion, but can occur when using some versions of the Microsoft Access ODBC driver. \n \nWe have created a new Allaire Security Bulletin that documents this issue and the steps \nthat customers can take to protect themselves. If you are using Microsoft Access with \nyour Web applications we strongly recommend that you review this new bulletin: \n \nASB99-09: Solutions to Issues that Allow Users to Execute Commands through \nMicrosoft Access \n \nYou can find this new bulletin and information about other security issues in the \nAllaire Security Zone: \n \nhttp://www.allaire.com/security \n \nAs a Web application platform vendor, one of our highest concerns is the security \nof the systems our customers deploy. We understand how important security is to \nour customers, and we're committed to providing the technology and information customers \nneed to build secure Web applications. Allaire has set up an email address that customers \ncan use to report security issues associated with an Allaire product: secure@allaire.com. \n \nThank you for your time and consideration on this issue. \n \n-- Allaire Security Response Team \n \n---------------------------------------------------------------------------------------- \n \n<http://www.allaire.com/handlers/index.cfm?ID=11069&Method=Full> \n \nAllaire Security Bulletin (ASB99-09) \n \nSolutions to Issues that Allow Users to Execute Commands through Microsoft Access \n \nOriginally Posted: June 1, 1999 \nLast Updated: June 1, 1999 \n \nSummary \nSome Microsoft ODBC drivers for Microsoft Access may allow users to execute Visual Basic \nfor Applications (VBA) commands on the hosted server without permission. URL, form and \ncookie variables in a dynamic query in many development environments (e.g. ColdFusion, ASP, \nCGI, etc.) can be used to exploit this hole appending malicious VBA statements to existing \nqueries. This problem can be easily fixed by upgrading to the Microsoft ODBC driver for Access \nincluded in MDAC 2.1 sp1a, available from Microsoft. In general, Allaire recommends that \ncustomers use proper coding methods for validating dynamic query variables passed on URL \nstrings, http forms or cookies. This is not a security issue with ColdFusion itself. However, \nColdFusion customers using Access are vulnerable to this issue. (This issue is similar to the \nvulnerabilities documented in ASB99-04, which are associated with appending malicious SQL \nstatements to query strings sent to some enterprise databases.) \n \nIssue \nIn a Web application there are often circumstances where queries are built dynamically using \nvariables that are passed on URLs or in forms. Some versions of the Microsoft Access ODBC \ndriver support the ability to append VBA commands to a SQL string. As a result, a malicious \nattack could be made by using URL, form or cookie variables to send VBA commands through a \nquery. These VBA commands could potentially be used to damage the server or to gain \nunauthorized access to information and systems. (The potential for a similar problem using SQL \nstatements and some enterprise database was documented in ASB99-04). \n \nSome versions of the Microsoft Access ODBC driver allow for appending VBA commands to a \nSQL string. The VBA commands are appended by using the pipe character, or Chr(124), which \nis treated as a reserved character by the Access ODBC driver. See the following MS \nKnowledge Base article for details: \nhttp://support.microsoft.com/support/kb/articles/q147/6/87.asp \n \nThis reserved character allows users to modify a URL, form or cookie variable to execute VBA \ncommands against the Web server using the ODBC driver. The following string is an example \nof one that can be used to initiate an attack by writing a file to the web server\u0092s hard drive: \n \n'|shell(\"cmd /c 1 > c:\\temp\\foo.txt\")|' \n \nThis string could be passed to an application using a URL variable, so the page could be called \nas follows: \n \nhttp://myserver/page.cfm?x='|shell(\"cmd /c 1 > c:\\temp\\foo.txt\")|' \n \nThis code, when executed as part of the following dynamically created query, will cause a file to \nbe created at the location c:\\temp\\foo.txt. \n \n<CFQUERY name=\"getUsers2\" DATASOURCE=\"test1\"> \nSELECT * \nFROM USERS \nWHERE lname = '#URL.X#' \n</CFQUERY> \n \nThis code could also be vulnerable when processing form input from a template using a form \nvariable called 'X'. Please note that you should always validate user-initiated input, including \nURL, form, and cookie variables. \n \nAffected Software Versions \n \nColdFusion Server (all versions and editions) running with Microsoft Access through \nODBC \n \nWhat Allaire is Doing \nThis issue is not a problem with ColdFusion, but can occur when using Microsoft Access and \nsome versions for the Access ODBC driver. It is not a problem with ColdFusion, but it can \naffect ColdFusion applications that use Access. To respond to this issue, Allaire has published \nan Allaire Security Bulletin (ASB99-09) notifying customers of the problem and remedies that \ncan be used to address it. We have sent a notification of the bulletin to customers who have \nsubscribed to Allaire Security Notifications. \n \nWhat Customers Should Do \nThis issue appears to be fixed by the installation of the Microsoft Access ODBC driver included \nwith MDAC 2.1 sp1a. We strongly recommend that customers install this ODBC driver. It \nshould not adversely affect the functionality of ColdFusion applications using Access. This \nMDAC can be downloaded from the Microsoft site: \n \nhttp://download.microsoft.com/msdownload/mdac/sp1a/x86/en/mdac_typ.exe \n \nIn addition, Allaire recommends that customers write their code to validate variables that are \npassed into SQL statements, configure their database security properly, and use standard \ndatabase application development practices such as stored procedures where appropriate to \nprotect themselves. These are general requirements of production applications regardless of the \ndevelopment platform. \n \nThere are many ways to address the issues raised by the risk of malicious SQL statements being \ninserted into dynamic queries. The Allaire Technical Brief \u0096 Securing Databases for ColdFusion \nApplications, details some of the steps you can take to secure your databases. \n \nIt is important to note that each individual application may require its own particular steps in \nboth coding and database configuration in order to be fully secured. Some of the techniques \nfor securing database applications built with ColdFusion are detailed in the Allaire Technical Brief \n- Securing Databases for ColdFusion Applications. \n \nRevisions \nJune 1, 1999 -- Bulletin first released. \n \nReporting Security Issues \nAllaire is committed to addressing security issues and providing customers with the information \non how they can protect themselves. If you identify what you believe may be a security issue \nwith an Allaire product, please send an email to secure@allaire.com. We will work to \nappropriately address and communicate the issue. \n \nReceiving Security Bulletins \nWhen Allaire becomes aware of a security issue that we believe significantly affects our products \nor customers, we will notify customers when appropriate. Typically this notification will be in the \nform of a security bulletin explaining the issue and the response. Allaire customers who would \nlike to receive notification of new security bulletins when they are released can sign up for our \nsecurity notification service. \n \nFor additional information on security issues at Allaire, please visit: \nhttp://www.allaire.com/security \n \nTHE INFORMATION PROVIDED BY ALLAIRE IN THIS BULLETIN IS PROVIDED \"AS IS\" \nWITHOUT WARRANTY OF ANY KIND. ALLAIRE DISCLAIMS ALL WARRANTIES, EITHER \nEXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND \nFITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL ALLAIRE CORPORATION \nOR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, \nINDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL \nDAMAGES, EVEN IF ALLAIRE CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED \nOF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE \nEXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL \nDAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. \n`\n", "edition": 1, "references": [], "modified": "1999-08-17T00:00:00", "hash": "db13927231e1d1e2136af416ed80e638cfd790762c8f93a6eedc0e48daebe6f7", "cvelist": [], "history": [], "bulletinFamily": "exploit", "href": "https://packetstormsecurity.com/files/11803/ms.odbc.coldfusion.txt.html", "description": "", "id": "PACKETSTORM:11803", "reporter": "Packet Storm", "lastseen": "2016-11-03T10:21:49", "published": "1999-08-17T00:00:00", "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "vulnersScore": 7.5}, "objectVersion": "1.2", "type": "packetstorm", "cvss": {"vector": "NONE", "score": 0.0}, "title": "ms.odbc.coldfusion.txt", "viewCount": 1, "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "d4be9c4fc84262b4f39f89565918568f", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "description"}, {"hash": "fedacca983d6f91f52e432f1174d2027", "key": "href"}, {"hash": "9c9724194c79e3f95cb8597d199abea6", "key": "modified"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "9c9724194c79e3f95cb8597d199abea6", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "7e63640ffbb0546f3e2929f550c8818d", "key": "reporter"}, {"hash": "78772e6af075ca2f318590babfe36d68", "key": "sourceData"}, {"hash": "cfed99c14cce146b407fe6552284a835", "key": "sourceHref"}, {"hash": "fb6549c9a23cd2b10e4d1cdab26216b4", "key": "title"}, {"hash": "6466ca3735f647eeaed965d9e71bd35d", "key": "type"}]}