Demarc PureSecure Authentication Check SQL Injection Vulnerability

Bugtraq ID:	4520
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 15 2002 12:00AM
Updated:	Apr 15 2002 12:00AM
Credit:	Discovered by pokleyzz sakamaniaka <[email protected]>.
Vulnerable:	Demarc PureSecure 1.0.5 Windows - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Professional - Snort Project Snort 1.8.3 Demarc PureSecure 1.0.5 Unix - Snort Project Snort 1.8.3
Not Vulnerable:

Demarc PureSecure Authentication Check SQL Injection Vulnerability

Solution:
pokleyzz sakamaniaka <[email protected]> has suggested making the following addition to the PureSecure script:

line 6113: &safe_slash(\$session_id' );

Demarc has announced that this issue will be resolved in version 1.6 of PureSecure, sceduled for release on April 18, 2002. The following official patch is also provided:

--- demarc Sun Nov 11 23:48:39 2001
+++ demarc-patched Tue Apr 16 12:49:56 2002
@@ -6094,6 +6094,7 @@
################
sub check_login{
my ($session_id) = @_;
+$session_id=~tr/[a-zA-Z0-9]//dc;

($session_id) || return;
&expire_sessions;