Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

5/16/2012
02:59 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Digital Defense Identifies Vulnerability On Epicor Software Interface

Vulnerability could potentially be leveraged by an attacker to execute arbitrary SQL commands

San Antonio, TX – May, 16, 2012 – Digital Defense, Inc. (DDI), a leading provider of managed cloud-based security assessments, announced the organization’s discovery of a blind SQL injection vulnerability in the Epicor Returns Management software SOAP interface. Left unremediated, this vulnerability could potentially be leveraged by an attacker to execute arbitrary SQL commands and extract information from the backend database using standard SQL exploitation techniques. Additionally, an attacker may be able to exploit this flaw to compromise the database server host operating system.

DDI followed their ethical disclosure policy, which included the immediate notification of Epicor Software Corporation. Epicor has now confirmed that they have contacted the customers affected and have made an update available to address this vulnerability. Epicor has also advised DDI that the codebase for Returns Management software might differ significantly from customer to customer, and has suggested that some customer installs may not contain this specific vulnerability due to this codebase variability. DDI recommends that any customer currently utilizing Epicor Returns Management software within their enterprise install the update Epicor has made available and, if concerned, log a support call with Epicor directly to determine if their codebase contains this vulnerability.

Larry Hurtado, DDI President & CEO, states, “DDI has emerged as an industry leader in the disclosure of zero day vulnerabilities. Our Collective Security Intelligence, offered through our cloud-based platform, provides our clients an extra measure of peace of mind knowing that our technology and expertise result in the rapid identification of vulnerabilities, which may otherwise go undetected. We responsibly communicate vulnerability information to clients, vendors, and ultimately the public so that remediation solutions can be developed quickly and effectively.”

About Digital Defense

Digital Defense, Inc. is a leading provider of managed, cloud-based security assessments, providing clients high value solutions through best-in-class service. DDI’s proprietary online vulnerability management system, Frontline Solutions Platform, combined with certified Security Analysts, delivers one of the most powerful and comprehensive assessment results and remediation management offerings in the marketplace. For more information about Digital Defense, please visit our web site at www.ddifrontline.com or contact us at 888.273.1412.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7343
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
CVE-2020-28476
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
CVE-2020-28473
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...
CVE-2021-25173
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which allows attackers to cause a crash, potentially enabling denial of service (crash, exit, or restart).
CVE-2021-25174
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can allow attackers to cause a crash, potentially enabling denial of service (Crash, Exit, or Restart).