Title: The DBMS must check the validity of data inputs.
Vulnerability ID: V-32555
IA Controls: None
Description: Invalid user input occurs when a user inserts data or characters into an applications data entry fields and the application is unprepared to process that data. This results in unanticipated application behavior potentially leading to an application or information system compromise. Invalid user input is one of the primary methods employed when attempting to compromise an application.
All applications need to validate the data users attempt to input to the application for processing. Rules for checking the valid syntax and semantics of information system inputs (e.g., character set, length, numerical range, acceptable values) are in place to verify inputs match specified definitions for format and content. Inputs passed to interpreters are prescreened to prevent the content from being unintentionally interpreted as commands.
Check Text: Review DBMS code, settings, field definitions, and constraints to determine whether or not data being input into the database is valid. If code exists that allows invalid data to be acted upon or input into the database, this is a finding.
If field definitions do not exist in the database, this is a finding.
If fields do not contain constraints where required, this is a finding.
Fix Text: Modify database code to properly validate data before it is put into the database or acted upon by the database.
Modify database to contain field definitions for each field in the database.
Modify database to contain constraints on database columns and tables that require them for data validity.[divider]
By properly defining data types in SQL Server you can meet the basic guidelines for this STIG. You also gaint he benefit of better performance when you size the data fields, and thus the database correctly.
Other options to ‘check’ data are the use of various constraints. You can use foreign constraints to ensure the data entered matches that in the reference table. You can also use unique constraints and range constraints to ensure appropriate values are inserted into the database.