bugtraq - [Argeniss] Oracle Database 10gR1 Buffer overflow in VERIFY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060420000256.96749.qmail@web54413.mail.yahoo.com>
Date: Wed, 19 Apr 2006 17:02:56 -0700 (PDT)
From: Cesar <cesarc56@...oo.com>
To: bugtraq@...urityfocus.com
Cc: full-disclosure@...ts.grok.org.uk, vulnwatch@...nwatch.org
Subject: [Argeniss] Oracle Database 10gR1 Buffer overflow
	in VERIFY_LOG procedure

Argeniss Security Advisory

Name:  Oracle Database 10gR1 Buffer overflow in
VERIFY_LOG procedure (DB03)
Affected Software:  Oracle Database Server version
10gR1
Severity:  High
Remote exploitable:  Yes (Authentication to Database
Server is needed)
Credits:  Esteban Martínez Fayó
Date:  4/18/2006
Advisory Number:  ARG040603

Details: 
Oracle Database Server provides the DBMS_SNAPSHOT_UTL
package that includes capability to manage
materialized views.
This package contains the public procedure VERIFY_LOG
that is vulnerable to buffer overflow.

By default DBMS_SNAPSHOT_UTL has EXECUTE permission to
PUBLIC so any Oracle database user can exploit this
vulnerability.
Exploitation of this vulnerability allows an attacker
to execute arbitrary code. It can also be exploited to
cause DoS (Denial of Service) killing Oracle server
process. 

Vendor Status:
Vendor was contacted and a Critical Patch Update was
released.

Workaround:
Restrict access to the DBMS_SNAPSHOT_UTL package (See
Links section).

Patch Available:
Although this security bug is addressed in the
Critical Patch Update April 2006, for most of the
affected platforms there are no patches available at
this moment.
Oracle informed that the missing patches would be
available on 01-May-06 !!!!

Links:
http://www.argeniss.com/research/ARGENISS-ADV-040603.txt
http://www.argeniss.com/research/Workaround-ADV-040603.sql
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html

Spam:
Searching for Oracle 0days? 
Argeniss Ultimate 0day Exploits Pack
http://www.argeniss.com/products.html

Argeniss - Information Security
*Application Security Experts*
http://www.argeniss.com

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/