Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
Database
Search
Advisories by Product
Advisories by Vendor
Terminology
Report Vulnerability
Insecure Library Loading
Moderately critical

Oracle Products Multiple Vulnerabilities

-

Release Date:  2008-10-15    Last Update:  2008-11-12    Views:  21,398

Secunia Advisory SA32291

Where:

From remote

Impact:

Unknown, Security Bypass, Brute force

Solution Status:

Vendor Patch

CVE Reference(s):

Description


Some vulnerabilities have been reported in various Oracle products. Some vulnerabilities have unknown impacts while others can be exploited by malicious users to conduct SQL injection attacks and by malicious people to conduct brute force attacks or bypass certain security restrictions.

1) An error in PeopleTools' authentication mechanism can be exploited to conduct brute force attacks.

2) An error in Oracle DBMS can be exploited to bypass the authentication mechanism via a specially crafted authentication message sent to the database server.

Successful exploitation requires knowledge of the session ID and the serial number of an existing session opened through the proxy account, and that "proxy authentication mode" is used.

3) A weakness in Oracle Application Express (APEX) is caused due to excessive privileges assigned to the FLOWS database account.

4) Input is not properly sanitised before being used in the COMPRESSWORKSPACETREE, MERGEWORKSPACE, and REMOVEWORKSPACE procedures within the "LT" PL/SQL package of the Oracle Workspace Manager component. This can be exploited to manipulate and execute SQL queries with escalated privileges (SYS or WMSYS).

5) Input is not properly sanitised before being used in the COMPRESSSTATE and GOTOTS procedures within the "LTADM" PL/SQL package of the Oracle Workspace Manager component. This can be exploited to manipulate and execute SQL queries with escalated privileges (SYS or WMSYS).

Successful exploitation of this vulnerability requires the "EXECUTE" privilege on the package [WM]SYS.LTADM.

6) Input is not properly sanitised before being used in the ALTER_AUTOLOG_CHANGE_SOURCE procedure within the "DBMS_CDC_PUBLISH" PL/SQL package. This can be exploited to manipulate and execute SQL queries with escalated privileges (SYS).

Successful exploitation of this vulnerability requires the "EXECUTE" privilege on the package SYS.DBMS_CDC_PUBLISH.

7) Input is not properly sanitised before being used in the ALTER_HOTLOG_INTERNAL_CSOURCE procedure within the "DBMS_CDC_IPUBLISH" PL/SQL package. This can be exploited to manipulate and execute SQL queries with escalated privileges (SYS).

Successful exploitation of this vulnerability requires the "EXECUTE privilege on the package SYS.DBMS_CDC_IPUBLISH.

The remaining vulnerabilities are caused due to unspecified errors. No more information is currently available.

The vulnerabilities are reported in the following products and versions:
* Oracle Database 11g, version 11.1.0.6
* Oracle Database 10g Release 2, versions 10.2.0.2, 10.2.0.3, 10.2.0.4
* Oracle Database 10g, version 10.1.0.5
* Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV
* Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.3.0,10.1.3.4.0
* Oracle Application Server 10g Release 2 (10.1.2), versions 10.1.2.2.0, 10.1.2.3.0
* Oracle Application Server 10g (9.0.4), version 9.0.4.3
* Oracle E-Business Suite Release 12, version 12.0.4
* Oracle E-Business Suite Release 11i, version 11.5.10.2
* Oracle PeopleSoft Enterprise PeopleTools versions 8.48.18, 8.49.14
* Oracle PeopleSoft Enterprise Portal versions 8.9, 9.0
* Oracle JD Edwards EnterpriseOne Tools versions 8.97, 8.98
* Oracle Application Server 9i Release 1, version 1.0.2.2


Solution:
Apply patches (see the vendor's advisory).

Provided and/or discovered by:
The vendor credits:
* Esteban Martinez Fayo, Application Security, Inc.
* Pete Finnigan
* Tony Fogarty, DNV
* guyp, Sentrigo
* Jack Kanter, Integrigy
* Joxean Koret
* Alexander Kornbrust, Red Database Security
* Slavik Markovich, Sentrigo
* Amichai Shulman, Imperva, Inc.
* Chris Valasek, IBM Corp.

1) Yaniv Azaria, Imperva

Original Advisory:
Oracle:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2008.html

Amichai Shulman, Yaniv Azaria:
http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/065146.html
http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/065147.html

Pete Finnigan:
http://www.petefinnigan.com/Advisory_CPU_Oct_2008.htm

Application Security, Inc:
http://www.appsecinc.com/resources/alerts/oracle/2008-08.shtml
http://www.appsecinc.com/resources/alerts/oracle/2008-09.shtml
http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml
http://www.appsecinc.com/resources/alerts/oracle/2008-11.shtml

Deep Links:
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Oracle Products Multiple Vulnerabilities

No posts yet

-

You must be logged in to post a comment.



 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Factsheets
Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability