The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Oracle Ultra Search Excessive Privileges
------------------------------------------------------------------------
SUMMARY
Oracle Ultra-Search uses database and Oracle text functionallity to
provide a uniform search function that is fully integrated with the SQL
language and where it allows full text search capabilities within the
database. For more details see
<http://support.cs.nott.ac.uk/help/docs/databases/oracle/standard/ultra.101/b10731/over.htm>
Introduction to Oracle Ultra Search. The issue located by PeteFinnigan.com
Limited relates to excessive privileges assigned to the WKSYS database
schema/user account.
DETAILS
Versions affected
The following Oracle database versions are affected
* Database
o 9.2.0.8 and lower
o 10.1.0.5 and lower
o 10.2.0.3 and lower
* Application Server
o 9.0.4.3 and lower
o 10.1.2.2 and lower
* Collaboration Suite
o 10.1.2 and lower
Risk
If the WKSYS schema exists then the risk is still present without
application of the patch. The CVSS score is 3.0 which is low but the risk
increases if the schema is accessible due to a weak password or an
additional attack vector that allows code to run as WKSYS. Access to the
schema, either directly or indirectly are required to expliot this issue.
Workaround
If the Oracle Ultra-Search functionallity is not required either directly
or indirectly then ensure that this component is not installed. This can
be verified by checking if the WKSYS schema is present in the database.
Patch Information
PeteFinnigan.com Limited advises customers to apply the January 2008 CPU
patch as soon as is practical. See Oracle's
<http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2008.html>
advisory for details of the patch availability matrix.
ADDITIONAL INFORMATION
The information has been provided by <mailto:pete@petefinnigan.com> Pete
Finnigan.
The original article can be found at:
<http://www.petefinnigan.com/Advisory_CPU_Jan_2008.htm>
http://www.petefinnigan.com/Advisory_CPU_Jan_2008.htm
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
