|
 |
|
Oracle Products Multiple Vulnerabilities
|
|
|
|
|
Secunia Advisory:
|
SA12409
|
|
|
Release Date:
|
2004-09-01
|
|
Last Update:
|
2005-01-19
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
Unknown
Manipulation of data
Exposure of system information
Exposure of sensitive information
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Oracle Application Server 10g
Oracle Database 10.x
Oracle Database 8.x
Oracle Enterprise Manager 10.x
Oracle9i Application Server
Oracle9i Database Enterprise Edition
Oracle9i Database Standard Edition
|
| | CVE reference: | CVE-2004-0637 (Secunia mirror)
CVE-2004-0638 (Secunia mirror)
CVE-2004-1362 (Secunia mirror)
CVE-2004-1363 (Secunia mirror)
CVE-2004-1364 (Secunia mirror)
CVE-2004-1365 (Secunia mirror)
CVE-2004-1366 (Secunia mirror)
CVE-2004-1367 (Secunia mirror)
CVE-2004-1368 (Secunia mirror)
CVE-2004-1369 (Secunia mirror)
CVE-2004-1370 (Secunia mirror)
CVE-2004-1371 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Multiple vulnerabilities with an unknown impact have been reported in various Oracle products. Reportedly, some of the vulnerabilities can be exploited to compromise a vulnerable system, cause a DoS (Denial of Service), or conduct SQL injection attacks.
1) A boundary error in the Database Server within the "dbms_system.ksdwrt()" function can be exploited to cause a buffer overflow by passing an overly long argument.
Successful exploitation allows a malicious, privileged user (member of "SYS" or "SYSTEM" roles or with execute permissions on the dbms_system package) to crash the Oracle server process and potentially execute arbitrary code.
2) Even though the account "ctxsys" is locked by default, the ctxsys.driload package is still accessible by users and can be exploited to execute commands as DBA.
Successful exploitation requires a database connection with execute permissions on the ctxsys.driload package.
3) A boundary error within the "sys_context()" function can be exploited by a malicious user to cause a buffer overflow.
4) Boundary errors within more than 300 procedures of the various replication management API packages can be exploited to cause buffer overflows by passing an overly long argument.
Successful exploitation of the majority requires a "SYSDBA" role or execute permissions on the vulnerable packages. However, some vulnerabilities can be exploited by any database user and may crash the Oracle server process or allow execution of arbitrary code.
5) A boundary error within the handling of the "gname" and "fname" parameters in procedures of various replication management API packages can be exploited to cause a buffer overflow.
Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE" or "SYSDBA" roles or with execute permissions on the vulnerable packages) to crash the Oracle server process or execute arbitrary code.
6) Boundary errors within the handling of the "sname", "oname", "type", "gowner", and "operation" parameters in procedures of the "DBMS_REPCAT" package can be exploited to cause buffer overflows.
Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE" or "SYSDBA" roles or with execute permissions on the "DBMS_REPCAT" package) to crash the Oracle server process or execute arbitrary code.
7) A boundary error within the handling of the "TEMPFILE" parameter when creating or altering a tablespace or database can be exploited to cause buffer overflows.
Successful exploitation allows a malicious, privileged user with the "ALTER DATABASE", "CREATE TABLESPACE", or "ALTER TABLESPACE" system privilege to crash the Oracle server process or execute arbitrary code.
8) Boundary errors within the handling of the "LOGFILE", "CONTROLFILE", and "FILE" parameters when altering a database can be exploited to cause buffer overflows.
Successful exploitation allows a malicious, privileged user with the "ALTER DATABASE" system privilege to crash the Oracle server process or execute arbitrary code.
9) Boundary errors within the Interval and String Conversion functions can be exploited to cause a buffer overflow by passing an overly long argument.
Successful exploitation allows a malicious user to crash the Oracle server process or execute arbitrary code.
10) A boundary error within the handling of the "DATAFILE" parameter when creating or altering a tablespace, database, index, or cluster can be exploited to cause buffer overflows.
Successful exploitation allows a malicious, privileged user with the "ALTER ANY INDEX", "ALTER DATABASE", "CREATE TABLESPACE", or "ALTER ANY CLUSTER" system privilege to crash the Oracle server process or execute arbitrary code.
11) A boundary error within the "START_LOG" function of the "CTX_OUTPUT" package can be exploited to cause a buffer overflow by passing an overly long argument.
Successful exploitation allows a malicious, privileged user (member of the "CTXAPP" role or with execute permissions on the "CTX_OUTPUT" package) to crash the Oracle server process or execute arbitrary code.
12) A boundary error within the Oracle 10g iSQL*PLus Service can be exploited to cause a heap-based buffer overflow by passing an overly long string in "username" or "connectID" parameter of "/isqlplus/login.uix".
Successful exploitation allows a malicious person to crash the Oracle server process or execute arbitrary code.
13) A boundary error within the "AQ_TABLE_DEFN_UPDATE" procedure of the "DBMS_AQ_IMPORT_INTERNAL" package can be exploited to cause a buffer overflow by passing an overly long "QT_NAME" parameter.
Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE", "EXP_FULL_DATABASE", "EXP_FULL_DATABASE", "AQ_ADMINISTRATOR_ROLE", or "SYSDBA" roles or with execute permissions on the "DBMS_AQ_IMPORT_INTERNAL" package) to crash the Oracle server process or execute arbitrary code.
14) Boundary errors within the "VERIFY_QUEUE_TYPES_GET_NRP" and "VERIFY_QUEUE_TYPES_NO_QUEUE" procedures of the "DBMS_AQADM" package can be exploited to cause a buffer overflow by passing an overly long "SRC_QUEUE_NAME" parameter.
Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE", "IMP_FULL_DATABASE", "IMP_FULL_DATABASE", "QS_ADM", "QS", "QS_WS", "QS_ES", "QS_OS", "QS_CBADM", "QS_CB", "QS_CS", or "SYSDBA" roles or with execute permissions on the "DBMS_AQADM" package) to crash the Oracle server process or execute arbitrary code.
15) A boundary error within the "VERIFY_QUEUE_TYPES" procedure of the "DBMS_AQADM_SYS" package can be exploited to cause a buffer overflow by passing an overly long "SRC_QUEUE_NAME" parameter.
Successful exploitation allows a malicious, privileged user (member of the "SYSDBA" role or with execute permissions on the "DBMS_AQADM_SYS" package) to crash the Oracle server process or execute arbitrary code.
16) A boundary error within the "PARALLEL_PUSH_RECOVERY" procedure of the "DBMS_DEFER_INTERNAL_SYS" package can be exploited to cause a buffer overflow by passing an overly long "DESTINATION" parameter.
Successful exploitation allows a malicious, privileged user (member of the "SYSDBA" role or with execute permissions on the "DBMS_DEFER_INTERNAL_SYS" package) to crash the Oracle server process or execute arbitrary code.
17) A boundary error within the "DIFFERENCES" procedure of the "DBMS_RECTIFIER_DIFF" package can be exploited to cause a buffer overflow by passing an overly long argument.
Successful exploitation allows a malicious, privileged user (member of "EXECUTE_CATALOG_ROLE" or "SYSDBA" roles or with execute permissions on the "DBMS_RECTIFIER_DIFF" package) to crash the Oracle server process or execute arbitrary code.
18) A boundary error within the "PUSHDEFERREDTXNS" procedure of the "LTUTIL" package can be exploited to cause a buffer overflow by passing an overly long "REPGRPNAME" parameter.
Successful exploitation allows a malicious, privileged user (member of "WMSYS" or "SYSDBA" roles or with execute permissions on the "LTUTIL" package) to crash the Oracle server process or execute arbitrary code.
19) Boundary errors within the "SDO_CODE_SIZE" and "VALIDATE_GEOM" procedures of the "MD2" package can be exploited to cause a buffer overflow by passing an overly long "LAYER" parameter.
Successful exploitation allows a malicious user to crash the Oracle server process or execute arbitrary code.
20) A boundary error within the "SDO_CODE_SIZE" public procedure of the "SDO_ADMIN" package can be exploited to cause a buffer overflow by passing an overly long "LAYER" parameter.
Successful exploitation allows a malicious user to crash the Oracle server process or execute arbitrary code.
21) A boundary error within the "SUBINDEXPOPULATE" procedure of the "DRIDDLR" package can be exploited to cause a buffer overflow by passing an overly long "LOGFILE" parameter.
Successful exploitation allows a malicious, privileged user (member of the "SYSDBA" role or with execute permissions on the "DRIDDLR" package) to crash the Oracle server process or execute arbitrary code.
22) An error in the Oracle XDB Server when processing HTTP requests can be exploited to crash the Oracle database instance via a HTTP request containing a malformed HTTP header.
NOTE: Multiple other unspecified vulnerabilities reportedly also exist in the Database Server and the Listener, Oracle Application Server within the Portal and iSQL*Plus components, and Oracle Enterprise Manager.
The following products are affected (not necessarily by all vulnerabilities):
* Oracle Database 10g Release 1, version 10.1.0.2
* Oracle9i Database Server Release 2, versions 9.2.0.4 and 9.2.0.5
* Oracle9i Database Server Release 1, versions 9.0.1.4, 9.0.1.5 and 9.0.1.5 FIPS
* Oracle8i Database Server Release 3, version 8.1.7.4
* Oracle8 Database Release 8.0.6, version 8.0.6.3
* Oracle Enterprise Manager Grid Control 10g, version 10.1.0.2
* Oracle Enterprise Manager Database Control 10g, version 10.1.0.2
* Oracle Application Server 10g (9.0.4), versions 9.0.4.0 and 9.0.4.1
* Oracle9i Application Server Release 2, versions 9.0.2.3 and 9.0.3.1
* Oracle9i Application Server Release 1, version 1.0.2.2
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, scan using the Network Software Inspector.
Solution:
Apply appropriate patches (see the original vendor advisory).
http://metalink.oracle.com/
Provided and/or discovered by:
1-3) Alexander Kornbrust of Red Database Security
4-21) Esteban Martinez Fayo and Cesar Cerrudo of Application Security Inc.
22) Matt Moore of PenTest Limited
The vendor also credits the following people:
* Pete Finnigan
* Jonathan Gennick
* Stephen Kost of Integrigy
* David Litchfield of NGSS Limited
* Aaron Newman of Application Security Inc.
* Andy Rees of QinetiQ
* Christian Schaller of Siemens CERT
Changelog:
2004-09-02: Added links to US-CERT vulnerability notes and Application Security.
2004-09-07: Added links to iDEFENSE, Application Security, and Red Database Security advisories.
2004-09-24: Added link to Pentest Limited.
2004-12-28: Added Oracle8 Database Release 8.0.6, version 8.0.6.3 as affected.
2005-01-19: Added CVE references.
Original Advisory:
Oracle:
http://otn.oracle.com/deploy/security/pdf/2004alert68.pdf
iDEFENSE:
http://www.idefense.com/application/poi/display?id=135&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=136&type=vulnerabilities
Red Database Security:
http://www.red-database-security.com/advisory/advisory_20040903_1.html
http://www.red-database-security.com/advisory/advisory_20040903_2.html
http://www.red-database-security.com/advisory/advisory_20040903_3.html
Application Security:
http://www.appsecinc.com/resources/alerts/oracle/2004-0001/
Integrigy:
http://www.integrigy.com/alerts/OraAlert68OraAppsImpact.htm
Pentest Limited:
http://www.pentest.co.uk/documents/ptl-2004-04.html
Other References:
US-CERT VU#170830:
http://www.kb.cert.org/vuls/id/170830
US-CERT VU#435974:
http://www.kb.cert.org/vuls/id/435974
US-CERT VU#316206:
http://www.kb.cert.org/vuls/id/316206
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
45 Related Secunia Security Advisories, displaying 10
|
|
|
1. Oracle Products Multiple Vulnerabilities
|
|
2. Oracle Application Server Portal Authentication Bypass
|
|
3. Oracle Products Multiple Vulnerabilities
|
|
4. Oracle Products Multiple Vulnerabilities
|
|
5. Oracle Database PITRIG_DROPMETADATA Buffer Overflow Vulnerability
|
|
6. Oracle Products Multiple Vulnerabilities
|
|
7. Oracle Products Multiple Vulnerabilities
|
|
8. Oracle Products Multiple Vulnerabilities
|
|
9. Oracle Application Server DMS Cross-Site Scripting Vulnerability
|
|
10. Oracle "PROCESS_DUP_HANDLE" Privilege Escalation Vulnerability
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
