AppSecInc Advisory: Multiple vulnerabilities in Oracle Database Server
Date:
August 31, 2004
Detailed Information Provided Online At:
http://www.appsecinc.com/resources/alerts/oracle/2004-0001/
Credit:
These vulnerabilities were researched and discovered by Cesar Cerrudo
and Esteban Martinez Fayo of Application Security, Inc. (www.appsecinc.com)
Risk Level:
High
Abstract:
Multiple buffer overflow and denial of service (DoS) vulnerabilities
exist in the Oracle Database Server which allow database users to take
complete control over the database and optionally cause denial of service.
The official advisory from Oracle Corporation can be obtained from:
http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf
Details:
http://www.appsecinc.com/resources/alerts/oracle/2004-0001/
#1 - Buffer overflow in public procedure DROP_SITE_INSTANTIATION of
DBMS_REPCAT_INSTANTIATE package
#2 - Buffer overflow in public function INSTANTIATE_OFFLINE of
DBMS_REPCAT_INSTANTIATE package
#3 - Buffer overflow in public function INSTANTIATE_ONLINE of
DBMS_REPCAT_INSTANTIATE package
#4 - Buffer overflow on "gname" parameter on procedures of Replication
Management API Packages
#5 - Buffer overflow on "sname" and "oname" parameters on procedures of
DBMS_REPCAT package
#6 - Buffer overflow on "type" parameter on procedures of DBMS_REPCAT
package
#7 - Buffer overflow on "gowner" parameter on procedures of the
DBMS_REPCAT package
#8 - Buffer overflow on "operation" parameter on procedures of
DBMS_REPCAT package
#9 - Buffer overflow in procedure CREATE_MVIEW_REPGROUP of DBMS_REPCAT
package
#10 - Buffer overflow in procedure GENERATE_REPLICATION_SUPPORT of
DBMS_REPCAT package
#11 - Buffer overflow in procedures REGISTER_USER_REPGROUP and
UNREGISTER_USER_REPGROUP of DBMS_REPCAT_ADMIN package
#12 - Buffer overflow in functions INSTANTIATE_OFFLINE,
INSTANTIATE_ONLINE and procedure DROP_SITE_INSTANTIATION of
DBMS_REPCAT_RGT package
#13 - Buffer overflow on TEMPFILE parameter
#14 - Buffer overflow on LOGFILE parameter
#15 - Buffer overflow on CONTROLFILE parameter
#16 - Buffer overflow on FILE parameter
#17 - Buffer overflow in Interval Conversion Functions
#18 - Buffer overflow in String Conversion Function
#19 - Buffer overflow in CTX_OUTPUT Package Function
#21 - Buffer overflow on DATAFILE parameter
#22 - Buffer overflow in DBMS_SYSTEM package function
#24 - Buffer overflow on "fname" parameter of the DBMS_REPCAT* packages
#25 - Buffer overflow on procedures of the Replication Management API
packages
#26 - Heap based buffer overflow Vulnerability in Oracle 10g iSQL*PLus
Service
#27 - Buffer overflow in procedure AQ_TABLE_DEFN_UPDATE of
DBMS_AQ_IMPORT_INTERNAL package
#28 - Buffer overflow in procedure VERIFY_QUEUE_TYPES_GET_NRP of
DBMS_AQADM package
#29 - Buffer overflow in procedure VERIFY_QUEUE_TYPES_NO_QUEUE of
DBMS_AQADM package
#30 - Buffer overflow in procedure VERIFY_QUEUE_TYPES of DBMS_AQADM_SYS
package
#31 - Buffer overflow in procedure PARALLEL_PUSH_RECOVERY of
DBMS_DEFER_INTERNAL_SYS package
#32 - Buffer overflow in procedure ENABLE_PROPAGATION_TO_DBLINK of
DBMS_DEFER_REPCAT package
#33 - Buffer overflow in procedure DISABLE_RECEIVER_TRACE of
DBMS_INTERNAL_REPCAT package
#34 - Buffer overflow in procedure ENABLE_RECEIVER_TRACE of
DBMS_INTERNAL_REPCAT package
#35 - Buffer overflow in procedure VALIDATE of DBMS_INTERNAL_REPCAT package
#36 - Buffer overflow in procedure DIFFERENCES of DBMS_RECTIFIER_DIFF
package
#37 - Buffer overflow in procedure ADD_COLUMN of DBMS_REPCAT_RQ package
#39 - Buffer overflow in procedure IS_MASTER of DBMS_REPCAT_UTL package
#40 - Buffer overflow in procedure PUSHDEFERREDTXNS of LTUTIL package
#41 - Buffer overflow in public procedure SDO_CODE_SIZE of MD2 package
#42 - Buffer overflow in public procedure VALIDATE_GEOM of MD2 package
#43 - Buffer overflow in public procedure SDO_CODE_SIZE of SDO_ADMIN package
#44 - Buffer overflow in procedure SUBINDEXPOPULATE of DRIDDLR package
To determine if you are vulnerable, please download AppDetective from:
http://www.appsecinc.com/products/appdetective/oracle/
Comments:
Exploitation of these vulnerabilities will allow an attacker to
completely compromise the OS and the database if Oracle is running on
Windows platform, because Oracle must run under the local System account
or under an administrative account. If Oracle is running on *nix then
only the database would be compromised because Oracle runs mostly under
oracle user which has restricted permissions.
Workaround:
-Check packages permissions and remove public permissions. Set minimal
permissions that fit your needs.
-Restrict users to execute PL/SQL statements directly over the server.
-Periodically audit user permissions on all database objects.
-Lock users that aren't used.
-Change default passwords.
-Keep Oracle up to date with patches.
Vendor Contact:
Vendor was contacted and has released fixes.
Credit:
Esteban Martinez Fayo of Application Security, Inc. (www.appsecinc.com)
discovered all of the following issues:
#1,#2,#3,#4,#5,#6,#7,#8,#9,#10,#11,#12,#24,#25,#26,#27,#28,#29,#30,#31,#32,#33,#34,#35,#36,#37,#39,#40,#41,#42,#43,and
#44
Cesar Cerrudo of Application Security, Inc. (www.appsecinc.com)
discovered all of the following issues: #13,#14,#15,#16,#17,#18,#19,#21,#22
--
Thank you,
shatter[at]appsecinc(dot)com
Application Security, Inc.
phone: 212-947-8787
fax: 212-947-8788
----------------------------------------------------------------------
Application Security, Inc.
www.appsecinc.com
AppSecInc is the leading provider of database security solutions for
the enterprise. AppSecInc products proactively secure enterprise
applications at more than 200 organizations around the world by
discovering, assessing, and protecting the database against rapidly
changing security threats. By securing data at its source, we enable
organizations to more confidently extend their business with
customers, partners and suppliers. Our security experts, combined
with our strong support team, deliver up-to-date application
safeguards that minimize risk and eliminate its impact on business.
----------------------------------------------------------------------
