|
Oracle Products Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA12409
|
|
|
Release Date:
|
2004-09-01
|
|
Last Update:
|
2005-01-19
|
|
Popularity:
|
25,741 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
Unknown
Manipulation of data
Exposure of system information
Exposure of sensitive information
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Oracle Application Server 10g
Oracle Database 10.x
Oracle Database 8.x
Oracle Enterprise Manager 10.x
Oracle9i Application Server
Oracle9i Database Enterprise Edition
Oracle9i Database Standard Edition
|
|
|
Secunia CVSS-2 Score:
|
Available in Secunia business solutions 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| Advisory Content (Page 1 of 3) | [ 1 ] [ 2 ] [ 3 ] | |
|
Description:
Multiple vulnerabilities with an unknown impact have been reported in various Oracle products. Reportedly, some of the vulnerabilities can be exploited to compromise a vulnerable system, cause a DoS (Denial of Service), or conduct SQL injection attacks.
1) A boundary error in the Database Server within the "dbms_system.ksdwrt()" function can be exploited to cause a buffer overflow by passing an overly long argument.
Successful exploitation allows a malicious, privileged user (member of "SYS" or "SYSTEM" roles or with execute permissions on the dbms_system package) to crash the Oracle server process and potentially execute arbitrary code.
2) Even though the account "ctxsys" is locked by default, the ctxsys.driload package is still accessible by users and can be exploited to execute commands as DBA.
Successful exploitation requires a database connection with execute permissions on the ctxsys.driload package.
3) A boundary error within the "sys_context()" function can be exploited by a malicious user to cause a buffer overflow.
4) Boundary errors within more than 300 procedures of the various replication management API packages can be exploited to cause buffer overflows by passing an overly long argument.
Successful exploitation of the majority requires a "SYSDBA" role or execute permissions on the vulnerable packages. However, some vulnerabilities can be exploited by any database user and may crash the Oracle server process or allow execution of arbitrary code.
5) A boundary error within the handling of the "gname" and "fname" parameters in procedures of various replication management API packages can be exploited to cause a buffer overflow.
Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE" or "SYSDBA" roles or with execute permissions on the vulnerable packages) to crash the Oracle server process or execute arbitrary code.
6) Boundary errors within the handling of the "sname", "oname", "type", "gowner", and "operation" parameters in procedures of the "DBMS_REPCAT" package can be exploited to cause buffer overflows.
Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE" or "SYSDBA" roles or with execute permissions on the "DBMS_REPCAT" package) to crash the Oracle server process or execute arbitrary code.
7) A boundary error within the handling of the "TEMPFILE" parameter when creating or altering a tablespace or database can be exploited to cause buffer overflows.
Successful exploitation allows a malicious, privileged user with the "ALTER DATABASE", "CREATE TABLESPACE", or "ALTER TABLESPACE" system privilege to crash the Oracle server process or execute arbitrary code.
8) Boundary errors within the handling of the "LOGFILE", "CONTROLFILE", and "FILE" parameters when altering a database can be exploited to cause buffer overflows.
Successful exploitation allows a malicious, privileged user with the "ALTER DATABASE" system privilege to crash the Oracle server process or execute arbitrary code.
9) Boundary errors within the Interval and String Conversion functions can be exploited to cause a buffer overflow by passing an overly long argument.
Successful exploitation allows a malicious user to crash the Oracle server process or execute arbitrary code.
10) A boundary error within the handling of the "DATAFILE" parameter when creating or altering a tablespace, database, index, or cluster can be exploited to cause buffer overflows.
Successful exploitation allows a malicious, privileged user with the "ALTER ANY INDEX", "ALTER DATABASE", "CREATE TABLESPACE", or "ALTER ANY CLUSTER" system privilege to crash the Oracle server process or execute arbitrary code.
11) A boundary error within the "START_LOG" function of the "CTX_OUTPUT" package can be exploited to cause a buffer overflow by passing an overly long argument.
Successful exploitation allows a malicious, privileged user (member of the "CTXAPP" role or with execute permissions on the "CTX_OUTPUT" package) to crash the Oracle server process or execute arbitrary code.
12) A boundary error within the Oracle 10g iSQL*PLus Service can be exploited to cause a heap-based buffer overflow by passing an overly long string in "username" or "connectID" parameter of "/isqlplus/login.uix".
Successful exploitation allows a malicious person to crash the Oracle server process or execute arbitrary code.
13) A boundary error within the "AQ_TABLE_DEFN_UPDATE" procedure of the "DBMS_AQ_IMPORT_INTERNAL" package can be exploited to cause a buffer overflow by passing an overly long "QT_NAME" parameter.
Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE", "EXP_FULL_DATABASE", "EXP_FULL_DATABASE", "AQ_ADMINISTRATOR_ROLE", or "SYSDBA" roles or with execute permissions on the "DBMS_AQ_IMPORT_INTERNAL" package) to crash the Oracle server process or execute arbitrary code.
14) Boundary errors within the "VERIFY_QUEUE_TYPES_GET_NRP" and "VERIFY_QUEUE_TYPES_NO_QUEUE" procedures of the "DBMS_AQADM" package can be exploited to cause a buffer overflow by passing an overly long "SRC_QUEUE_NAME" parameter.
Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE", "IMP_FULL_DATABASE", "IMP_FULL_DATABASE", "QS_ADM", "QS", "QS_WS", "QS_ES", "QS_OS", "QS_CBADM", "QS_CB", "QS_CS", or "SYSDBA" roles or with execute permissions on the "DBMS_AQADM" package) to crash the Oracle server process or execute arbitrary code.
15) A boundary error within the "VERIFY_QUEUE_TYPES" procedure of the "DBMS_AQADM_SYS" package can be exploited to cause a buffer overflow by passing an overly long "SRC_QUEUE_NAME" parameter.
Successful exploitation allows a malicious, privileged user (member of the "SYSDBA" role or with execute permissions on the "DBMS_AQADM_SYS" package) to crash the Oracle server process or execute arbitrary code.
16) A boundary error within the "PARALLEL_PUSH_RECOVERY" procedure of the "DBMS_DEFER_INTERNAL_SYS" package can be exploited to cause a buffer overflow by passing an overly long "DESTINATION" parameter.
Successful exploitation allows a malicious, privileged user (member of the "SYSDBA" role or with execute permissions on the "DBMS_DEFER_INTERNAL_SYS" package) to crash the Oracle server process or execute arbitrary code.
17) A boundary error within the "DIFFERENCES" procedure of the "DBMS_RECTIFIER_DIFF" package can be exploited to cause a buffer overflow by passing an overly long argument.
Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE" or "SYSDBA" roles or with execute permissions on the "DBMS_RECTIFIER_DIFF" package) to crash the Oracle server process or execute arbitrary code.
18) A boundary error within the "PUSHDEFERREDTXNS" procedure of the "LTUTIL" package can be exploited to cause a buffer overflow by passing an overly long "REPGRPNAME" parameter.
Successful exploitation allows a malicious, privileged user (member of "WMSYS" or "SYSDBA" roles or with execute permissions on the "LTUTIL" package) to crash the Oracle server process or execute arbitrary code.
19) Boundary errors within the "SDO_CODE_SIZE" and "VALIDATE_GEOM" procedures of the "MD2" package can be exploited to cause a buffer overflow by passing an overly long "LAYER" parameter.
Successful exploitation allows a malicious user to crash the Oracle server process or execute arbitrary code.
20) A boundary error within the "SDO_CODE_SIZE" public procedure of the "SDO_ADMIN" package can be exploited to cause a buffer overflow by passing an overly long "LAYER" parameter.
Successful exploitation allows a malicious user to crash the Oracle server process or execute arbitrary code.
21) A boundary error within the "SUBINDEXPOPULATE" procedure of the "DRIDDLR" package can be exploited to cause a buffer overflow by passing an overly long "LOGFILE" parameter.
Successful exploitation allows a malicious, privileged user (member of the "SYSDBA" role or with execute permissions on the "DRIDDLR" package) to crash the Oracle server process or execute arbitrary code.
22) An error in the Oracle XDB Server when processing HTTP requests can be exploited to crash the Oracle database instance via a HTTP request containing a malformed HTTP header.
NOTE: Multiple other unspecified vulnerabilities reportedly also exist in the Database Server and the Listener, Oracle Application Server within the Portal and iSQL*Plus components, and Oracle Enterprise Manager.
The following products are affected (not necessarily by all vulnerabilities):
* Oracle Database 10g Release 1, version 10.1.0.2
* Oracle9i Database Server Release 2, versions 9.2.0.4 and 9.2.0.5
* Oracle9i Database Server Release 1, versions 9.0.1.4, 9.0.1.5 and 9.0.1.5 FIPS
* Oracle8i Database Server Release 3, version 8.1.7.4
* Oracle8 Database Release 8.0.6, version 8.0.6.3
* Oracle Enterprise Manager Grid Control 10g, version 10.1.0.2
* Oracle Enterprise Manager Database Control 10g, version 10.1.0.2
* Oracle Application Server 10g (9.0.4), versions 9.0.4.0 and 9.0.4.1
* Oracle9i Application Server Release 2, versions 9.0.2.3 and 9.0.3.1
* Oracle9i Application Server Release 1, version 1.0.2.2
Change Page:
[ 1 ] [ 2 ] [ 3 ]
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
Today
|
New advisories:
|
10 |
|
New vulnerabilities:
|
17 |
|
Updated advisories:
|
26 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 Solutions | More...
|
|
