full-disclosure - [VulnWatch] [AppSecInc Team SHATTER Security Advisory] SQL Injection in ALTER_MANUALLOG_CHANGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <000001c54479$24f08040$7d00a8c0@DesertComputerLLC.local>
Date: Tue Apr 19 01:45:10 2005
From: shatter at appsecinc.com (Team SHATTER)
Subject: [VulnWatch] [AppSecInc Team SHATTER Security
	Advisory] SQL Injection in ALTER_MANUALLOG_CHANGE_SOURCE
	procedure[Scanned]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SQL Injection in ALTER_MANUALLOG_CHANGE_SOURCE procedure

AppSecInc Team SHATTER Security Advisory
http://www.appsecinc.com/resources/alerts/oracle/2005-04.html
April 18, 2005

Affected versions: Oracle Database Server version 10g

Risk level: High

Credits: This vulnerability was discovered and researched by Esteban
Mart?nez Fay? of Argeniss for Application Security Inc.


Details:
The CHANGE_SOURCE_NAME parameter of the standard procedure
SYS.DBMS_CDC_IPUBLISH.ALTER_MANUALLOG_CHANGE_SOURCE is vulnerable to SQL
injection. This package executes with privileges of the SYS user; by
default, PUBLIC has EXECUTE privilege.


Impact:
Any low privileged database user can execute functions with DBA
privileges. Users with privilges to create or modify a function can
inject a user-defined function in the vulnerable procedure and thus
execute SQL statements with DBA privileges.


Workaround:
Revoke Execute privilege on the DBMS_CDC_IPUBLISH package


Vendor Status:
Vendor was contacted and a patch was released.


Fix:
Apply Oracle Critical Patch Update April 2005 available at
http://metalink.oracle.com


Links:
Application Security, Inc advisory:
http://www.appsecinc.com/resources/alerts/oracle/2005-04.html
Oracle security alert:
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf
Advanced SQL Injection in Oracle databases presentation:
http://www.argeniss.com/research.html

- --
_____________________________________________
Application Security, Inc.
www.appsecinc.com
AppSecInc is the leading provider of database security solutions for the
enterprise. AppSecInc products proactively secure enterprise
applications at more than 300 organizations around the world by
discovering, assessing, and protecting the database against rapidly
changing security threats. By securing data at its source, we enable
organizations to more confidently extend their business with customers,
partners and suppliers. Our security experts, combined with our strong
support team, deliver up-to-date application safeguards that minimize
risk and eliminate its impact on business.




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)

iD8DBQFCZAWn/0w1dSVRt4URAsX4AJ9Smw5RP05fns/uyQlC0rfZj8bm2gCgrTmv
Zqxq1NYOFfM9j6cy8cdiNeU=
=1GtZ
-----END PGP SIGNATURE-----