Secunia

David Litchfield has reported two security issues in Oracle Database, which can be exploited by malicious users to gain escalated privileges and compromise a vulnerable system.

1) Access to procedures within the "DBMS_JVM_EXP_PERMS" package is not restricted, which can be exploited to modify the Java policy table via the "IMPORT_JVM_PERMS" procedure.

This can be exploited to e.g. execute arbitrary operating system commands.

2) An error in the argument handling of the "DBMS_JAVA.SET_OUTPUT_TO_JAVA" procedure can be exploited to execute SQL commands as the SYS user.

This can be exploited to gain DBA user privileges.

NOTE: Successful exploitation allows bypassing Oracle Label Security.

Solution
Apply patches (please see the vendor's advisory for details).

Provided and/or discovered by
David Litchfield

Changelog
Further details available in Customer Area

Original Advisory
Oracle:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2010.html
http://blogs.oracle.com/security/2010/04/april_2010_critical_patch_upda.html

https://media.blackhat.com/bh-dc-10/video/Litchfield_David/BlackHat-DC-2010-Litchfield-Oracle11g-video.m4v
http://www.databasesecurity.com/HackingAurora.pdf
http://www.databasesecurity.com/bh-DC2010.pdf

Deep Links
Links available in Customer Area