English

Problem: ArcGIS 10.1 SP1 for Server contains a blind SQL injection vulnerability

Description

A blind SQL injection vulnerability in ArcGIS for Server 10.1 SP1 allows remote attackers to execute a subset of SQL commands via a query operation WHERE clause.

The ArcGIS 10.1 SP1 for Server Security patch addresses two SQL injection vulnerabilities in ArcGIS for Server when used with either enterprise geodatabases or relational databases through query layers. These vulnerabilities cannot be exploited on systems that only use file-based data.

The following issues that were reported to Esri, NIM085361 and NIM084249, have been fixed in this patch.

This vulnerability allows users to determine the fully qualified table name of the feature class, which reveals the database username and the name of the database server.

Cause

Under certain circumstances, ArcGIS for Server reveals fully qualified table names for layers within a map service.

Solution or Workaround

Esri recommends that customers using ArcGIS for Server 10.1 SP1 apply the ArcGIS 10.1 SP1 for Server Security patch listed in the Related Information section below.

Related Information