Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
Database
Search
Advisories by Product
Advisories by Vendor
Terminology
Report Vulnerability
Insecure Library Loading
Highly critical

Oracle Products Multiple Vulnerabilities

-

Release Date:  2004-09-01    Last Update:  2005-01-19    Views:  31,182

Secunia Advisory SA12409

Where:

From remote

Impact:

Unknown, Manipulation of data, Exposure of system information, Exposure of sensitive information, DoS, System access

Solution Status:

Vendor Patch

CVE Reference(s):

Description


Multiple vulnerabilities with an unknown impact have been reported in various Oracle products. Reportedly, some of the vulnerabilities can be exploited to compromise a vulnerable system, cause a DoS (Denial of Service), or conduct SQL injection attacks.

1) A boundary error in the Database Server within the "dbms_system.ksdwrt()" function can be exploited to cause a buffer overflow by passing an overly long argument.

Successful exploitation allows a malicious, privileged user (member of "SYS" or "SYSTEM" roles or with execute permissions on the dbms_system package) to crash the Oracle server process and potentially execute arbitrary code.

2) Even though the account "ctxsys" is locked by default, the ctxsys.driload package is still accessible by users and can be exploited to execute commands as DBA.

Successful exploitation requires a database connection with execute permissions on the ctxsys.driload package.

3) A boundary error within the "sys_context()" function can be exploited by a malicious user to cause a buffer overflow.

4) Boundary errors within more than 300 procedures of the various replication management API packages can be exploited to cause buffer overflows by passing an overly long argument.

Successful exploitation of the majority requires a "SYSDBA" role or execute permissions on the vulnerable packages. However, some vulnerabilities can be exploited by any database user and may crash the Oracle server process or allow execution of arbitrary code.

5) A boundary error within the handling of the "gname" and "fname" parameters in procedures of various replication management API packages can be exploited to cause a buffer overflow.

Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE" or "SYSDBA" roles or with execute permissions on the vulnerable packages) to crash the Oracle server process or execute arbitrary code.

6) Boundary errors within the handling of the "sname", "oname", "type", "gowner", and "operation" parameters in procedures of the "DBMS_REPCAT" package can be exploited to cause buffer overflows.

Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE" or "SYSDBA" roles or with execute permissions on the "DBMS_REPCAT" package) to crash the Oracle server process or execute arbitrary code.

7) A boundary error within the handling of the "TEMPFILE" parameter when creating or altering a tablespace or database can be exploited to cause buffer overflows.

Successful exploitation allows a malicious, privileged user with the "ALTER DATABASE", "CREATE TABLESPACE", or "ALTER TABLESPACE" system privilege to crash the Oracle server process or execute arbitrary code.

8) Boundary errors within the handling of the "LOGFILE", "CONTROLFILE", and "FILE" parameters when altering a database can be exploited to cause buffer overflows.

Successful exploitation allows a malicious, privileged user with the "ALTER DATABASE" system privilege to crash the Oracle server process or execute arbitrary code.

9) Boundary errors within the Interval and String Conversion functions can be exploited to cause a buffer overflow by passing an overly long argument.

Successful exploitation allows a malicious user to crash the Oracle server process or execute arbitrary code.

10) A boundary error within the handling of the "DATAFILE" parameter when creating or altering a tablespace, database, index, or cluster can be exploited to cause buffer overflows.

Successful exploitation allows a malicious, privileged user with the "ALTER ANY INDEX", "ALTER DATABASE", "CREATE TABLESPACE", or "ALTER ANY CLUSTER" system privilege to crash the Oracle server process or execute arbitrary code.

11) A boundary error within the "START_LOG" function of the "CTX_OUTPUT" package can be exploited to cause a buffer overflow by passing an overly long argument.

Successful exploitation allows a malicious, privileged user (member of the "CTXAPP" role or with execute permissions on the "CTX_OUTPUT" package) to crash the Oracle server process or execute arbitrary code.

12) A boundary error within the Oracle 10g iSQL*PLus Service can be exploited to cause a heap-based buffer overflow by passing an overly long string in "username" or "connectID" parameter of "/isqlplus/login.uix".

Successful exploitation allows a malicious person to crash the Oracle server process or execute arbitrary code.

13) A boundary error within the "AQ_TABLE_DEFN_UPDATE" procedure of the "DBMS_AQ_IMPORT_INTERNAL" package can be exploited to cause a buffer overflow by passing an overly long "QT_NAME" parameter.

Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE", "EXP_FULL_DATABASE", "EXP_FULL_DATABASE", "AQ_ADMINISTRATOR_ROLE", or "SYSDBA" roles or with execute permissions on the "DBMS_AQ_IMPORT_INTERNAL" package) to crash the Oracle server process or execute arbitrary code.

14) Boundary errors within the "VERIFY_QUEUE_TYPES_GET_NRP" and "VERIFY_QUEUE_TYPES_NO_QUEUE" procedures of the "DBMS_AQADM" package can be exploited to cause a buffer overflow by passing an overly long "SRC_QUEUE_NAME" parameter.

Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE", "IMP_FULL_DATABASE", "IMP_FULL_DATABASE", "QS_ADM", "QS", "QS_WS", "QS_ES", "QS_OS", "QS_CBADM", "QS_CB", "QS_CS", or "SYSDBA" roles or with execute permissions on the "DBMS_AQADM" package) to crash the Oracle server process or execute arbitrary code.

15) A boundary error within the "VERIFY_QUEUE_TYPES" procedure of the "DBMS_AQADM_SYS" package can be exploited to cause a buffer overflow by passing an overly long "SRC_QUEUE_NAME" parameter.

Successful exploitation allows a malicious, privileged user (member of the "SYSDBA" role or with execute permissions on the "DBMS_AQADM_SYS" package) to crash the Oracle server process or execute arbitrary code.

16) A boundary error within the "PARALLEL_PUSH_RECOVERY" procedure of the "DBMS_DEFER_INTERNAL_SYS" package can be exploited to cause a buffer overflow by passing an overly long "DESTINATION" parameter.

Successful exploitation allows a malicious, privileged user (member of the "SYSDBA" role or with execute permissions on the "DBMS_DEFER_INTERNAL_SYS" package) to crash the Oracle server process or execute arbitrary code.

17) A boundary error within the "DIFFERENCES" procedure of the "DBMS_RECTIFIER_DIFF" package can be exploited to cause a buffer overflow by passing an overly long argument.

Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE" or "SYSDBA" roles or with execute permissions on the "DBMS_RECTIFIER_DIFF" package) to crash the Oracle server process or execute arbitrary code.

18) A boundary error within the "PUSHDEFERREDTXNS" procedure of the "LTUTIL" package can be exploited to cause a buffer overflow by passing an overly long "REPGRPNAME" parameter.

Successful exploitation allows a malicious, privileged user (member of "WMSYS" or "SYSDBA" roles or with execute permissions on the "LTUTIL" package) to crash the Oracle server process or execute arbitrary code.

19) Boundary errors within the "SDO_CODE_SIZE" and "VALIDATE_GEOM" procedures of the "MD2" package can be exploited to cause a buffer overflow by passing an overly long "LAYER" parameter.

Successful exploitation allows a malicious user to crash the Oracle server process or execute arbitrary code.

20) A boundary error within the "SDO_CODE_SIZE" public procedure of the "SDO_ADMIN" package can be exploited to cause a buffer overflow by passing an overly long "LAYER" parameter.

Successful exploitation allows a malicious user to crash the Oracle server process or execute arbitrary code.

21) A boundary error within the "SUBINDEXPOPULATE" procedure of the "DRIDDLR" package can be exploited to cause a buffer overflow by passing an overly long "LOGFILE" parameter.

Successful exploitation allows a malicious, privileged user (member of the "SYSDBA" role or with execute permissions on the "DRIDDLR" package) to crash the Oracle server process or execute arbitrary code.

22) An error in the Oracle XDB Server when processing HTTP requests can be exploited to crash the Oracle database instance via a HTTP request containing a malformed HTTP header.

NOTE: Multiple other unspecified vulnerabilities reportedly also exist in the Database Server and the Listener, Oracle Application Server within the Portal and iSQL*Plus components, and Oracle Enterprise Manager.

The following products are affected (not necessarily by all vulnerabilities):
* Oracle Database 10g Release 1, version 10.1.0.2
* Oracle9i Database Server Release 2, versions 9.2.0.4 and 9.2.0.5
* Oracle9i Database Server Release 1, versions 9.0.1.4, 9.0.1.5 and 9.0.1.5 FIPS
* Oracle8i Database Server Release 3, version 8.1.7.4
* Oracle8 Database Release 8.0.6, version 8.0.6.3
* Oracle Enterprise Manager Grid Control 10g, version 10.1.0.2
* Oracle Enterprise Manager Database Control 10g, version 10.1.0.2
* Oracle Application Server 10g (9.0.4), versions 9.0.4.0 and 9.0.4.1
* Oracle9i Application Server Release 2, versions 9.0.2.3 and 9.0.3.1
* Oracle9i Application Server Release 1, version 1.0.2.2


Solution:
Apply appropriate patches (see the original vendor advisory).

Further details available to Secunia VIM customers

Provided and/or discovered by:
1-3) Alexander Kornbrust of Red Database Security
4-21) Esteban Martinez Fayo and Cesar Cerrudo of Application Security Inc.
22) Matt Moore of PenTest Limited

The vendor also credits the following people:
* Pete Finnigan
* Jonathan Gennick
* Stephen Kost of Integrigy
* David Litchfield of NGSS Limited
* Aaron Newman of Application Security Inc.
* Andy Rees of QinetiQ
* Christian Schaller of Siemens CERT

Original Advisory:
Oracle:
http://otn.oracle.com/deploy/security/pdf/2004alert68.pdf

iDEFENSE:
http://www.idefense.com/application/poi/display?id=135&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=136&type=vulnerabilities

Red Database Security:
http://www.red-database-security.com/advisory/advisory_20040903_1.html
http://www.red-database-security.com/advisory/advisory_20040903_2.html
http://www.red-database-security.com/advisory/advisory_20040903_3.html

Application Security:
http://www.appsecinc.com/resources/alerts/oracle/2004-0001/

Integrigy:
http://www.integrigy.com/alerts/OraAlert68OraAppsImpact.htm

Pentest Limited:
http://www.pentest.co.uk/documents/ptl-2004-04.html

Deep Links:
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Oracle Products Multiple Vulnerabilities

No posts yet

-

You must be logged in to post a comment.



 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Factsheets
Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability