bugtraq - Oracle multiple PL/SQL injection vulnerabilities (#NISR2122004H)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 23 Dec 2004 16:37:24 -0000
From: "NGSSoftware Insight Security Research" <nisr@...tgenss.com>
To: <bugtraq@...urityfocus.com>, <ntbugtraq@...tserv.ntbugtraq.com>,
	<vulnwatch@...nwatch.org>
Subject: Oracle multiple PL/SQL injection vulnerabilities (#NISR2122004H)

NGSSoftware Insight Security Research Advisory

Name: Oracle 10g/9i Multiple PL/SQL injection vulnerabilities
Systems Affected: Oracle 10g/AS on all operating systems	
Severity: High risk
Vendor URL: http://www.oracle.com/
Author: David Litchfield [ davidl at ngssoftware.com ]
Relates to: http://www.nextgenss.com/advisories/oracle-01.txt
Date of Public Advisory: 23rd December 2004
Advisory number: #NISR2122004H
Advisory URL: http://www.ngssoftware.com/advisories/oracle23122004H.txt

Description
***********
Oracle 10g and 9i suffer from multiple PL/SQL injection vulnerabilities.

Details
*******

When a PL/SQL procedure executes, it does so with the permissions of the
definer unless the AUTHID CURRENT USER keyword has been specified. In this
case the procedure executes with invoker privileges. Any procedure that uses
definer rights can be abused to gain elevated privileges if they are
vulnerable to PL/SQL injection. Known to be vulnerable are

Owner		Procedure

SYS 		DBMS_EXPORT_EXTENSION
WKSYS 	WK_ACL.GET_ACL
WKSYS 	WK_ACL.STORE_ACL
WKSYS		WK_ADM.COMPLETE_ACL_SNAPSHOT
WKSYS 	WK_ACL.DELETE_ACLS_WITH_STATEMENT
CTXSYS 	DRILOAD.VALIDATE_STMT 

Each of these can be exploited to gain DBA privileges. Further, attacks can
be affected via an Oracle Application Server without the attacker having a
user ID and password.

Note - CTXSYS is not a DBA in 10g but is on 9i.

Fix Information
***************
A patch (#68) was released for this problem by Oracle. See
http://metalink.oracle.com/ for more details. NGSSQuirreL for Oracle
(http://www.nextgenss.com/squirrelora.htm), can be used to assess whether
your Oracle servers are vulnerable to this.

About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@...software.com