DDIVRT-2012-44 Epicor Returns Management SOAP-Based Blind SQL Injection

[ddivulnalert@xxxxxxxxxxxxxxxx]

Title
-----
DDIVRT-2012-44 Epicor Returns Management SOAP-Based Blind SQL Injection

Severity
--------
High

Date Discovered
---------------
April 12, 2012

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Chris Graham and r@b13$

Vulnerability Description
-------------------------
Digital Defense, Inc. (DDI) has discovered a blind SQL injection vulnerability 
in the Epicor Returns Management software SOAP interface. Left unremediated, 
this vulnerability could be leveraged by an attacker to execute arbitrary SQL 
commands and extract information from the backend database using standard SQL 
exploitation techniques. Additionally, an attacker may be able to leverage this 
flaw to compromise the database server host operating system.

Solution Description
--------------------
Epicor Software Corporation has confirmed they have now contacted the customers 
affected, and have made an update available to address this vulnerability. As 
such, DDI recommends restricting access to the affected port/interface until 
installing the Epicor update or implementing another workaround to address the 
issue.

It should be noted that Epicor has advised DDI that the codebase for Returns 
Management software may differ significantly from customer to customer. Epicor 
has suggested that some customer installs may not contain this specific 
vulnerability as a result of this codebase variability.

DDI recommends that any customer currently utilizing Epicor Returns Management 
software within their enterprise install the update Epicor has made available 
and, if concerned about the applicability of the update, log a support call 
with Epicor directly to determine if their codebase contains this vulnerability.

Tested Systems / Software (with versions)
------------------------------------------
Epicor Returns Management
Windows Server 2003
Microsoft SQL Server 2000
Platform: Apache Tomcat/4.1.31

Vendor Contact
--------------
Epicor Software Corporation
www.epicor.com