David Litchfield has reported a vulnerability in various Oracle products, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error in the Oracle PL/SQL Gateway component during the validation of certain HTTP requests. This can be exploited to bypass the PLSQLExclusion list and gain access to excluded packages and procedures via specially-crafted HTTP requests.

Successful exploitation allows an attacker to gain DBA access to the database server through the web server.

The vulnerability has been reported in the PL/SQL Gateway component included in the Oracle Application Server and the Oracle HTTP Server.

Note: The affected component may also be included in other Oracle products.

Solution
Apply patches from the April Critical Patch Update (see vendor advisory).

Provided and/or discovered by
David Litchfield, NGSSoftware.

Changelog
Further details available in Customer Area

Original Advisory
Oracle:
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html

David Litchfield:
http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041742.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area