SQL Injection Attacks and Defense - 2009

Platform-Level Defenses • Chapter 9 403
Table 9.1 Determining SQL Server/Oracle Database Server Versions
Database Command Version Reference
SQL Server select @@version www.sqlsecurity.com/FAQs/
SQLServer
VersionDatabase/tabid/63/
Default.aspx
Oracle
-- show database version www.oracle.com/technology/
support/patches.htm
select * from v$version;
-- show version of
installed components
select * from dba_registry;
- show patchlevel
select * from
dba_registry_history;
Additional Deployment Considerations
This section covers additional security measures to help you secure deployed applications.
These are primarily configuration enhancements to the Web server and network infrastructure
to help slow the identification of applications that are potentially vulnerable to SQL injection.
These techniques can be useful as a first layer to prevent detection by automated SQL injection
worms that are becoming increasingly prevalent and dangerous. Additionally, we’ll look
at techniques to slow and/or mitigate exploitation once SQL injection has been identified.
Minimize Unnecessary Information Leakage
In general, leaking unnecessary information about software behavior significantly aides an
attacker in finding weaknesses within your application. Examples include software version
information that can be used to footprint a potentially vulnerable version of an application,
and error details related to an application failure, such as an SQL syntax error that occurs on
the database server. We’re going to look at ways to suppress this information declaratively
within application deployment descriptor files and hardening the Web server configuration.
Suppress Error Messages
Error messages that include information detailing why a database server failed are
extremely useful in the identification and subsequent exploitation of SQL injection.
Handling exceptions and suppression of error messages is most effective when done with
application-level error handlers. However, inevitably there is always the possibility of an