Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

DDIVRT-2011-39 SolarWinds Storage Manager Server SQL Injection Authentication Bypass
From: ddivulnalert <ddivulnalert () ddifrontline com>
Date: Mon, 23 Jan 2012 09:19:10 -0600

Title
-----
DDIVRT-2011-39 SolarWinds Storage Manager Server SQL Injection
Authentication Bypass

Severity
--------
High

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: r () b13$

Date Discovered
---------------
December 7, 2011

Vulnerability Description
-------------------------
The 'LoginServlet' page on port 9000 of the SolarWinds Storage Manager
Server is vulnerable to a SQL injection within the 'loginName' field.
An attacker can leverage this flaw to bypass authentication to the
Storage Manager application or to execute arbitrary SQL commands and
extract sensitive information from the backend database using standard
SQL exploitation techniques. Additionally, an attacker may be able to
leverage this flaw to compromise the database server host operating
system.

Solution Description
--------------------
SolarWinds has not yet provided a patch to address the issue. Digital
Defense, Inc. recommends restricting access to the affected port until
an update has been produced by the vendor.

Tested Systems / Software 
-------------------------
32-bit SolarWinds Storage Manager Server version 5.1.2 on Windows 2003

Vendor Contact
--------------
Name: SolarWinds
Website: http://www.solarwinds.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • DDIVRT-2011-39 SolarWinds Storage Manager Server SQL Injection Authentication Bypass ddivulnalert (Jan 23)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]