full-disclosure - Oracle - Hardcoded Password and Password Reset of OUTLN User [DB13]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 16 Apr 2008 12:29:29 +0400
From: Alexander Kornbrust <ak@...-database-security.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Oracle - Hardcoded Password and Password Reset of
	OUTLN User [DB13]

Oracle - Hardcoded Password and Password Reset of OUTLN User [DB13]

Systems Affected   9i Rel. 1 - 10g Rel. 2
Severity           High Risk
Category           Hardcoded Default Password & Password Reset
Vendor URL	       http://www.oracle.com/
Author	           Alexander Kornbrust
Advisory	       16 April 2008 (V 1.00)
Advisory URL           http://www.red-database-security.com/advisory/oracle_outln_password_change.html

Details
During the creation of a materialized view the package  
DBMS_STATS_INTERNAL is called and resets the password of the user  
OUTLN to OUTLN and grants DBA privileges to this user.

[...]
GRANT_DBA_OUTLN:= 'grant dba to outln identified by outln';
[...]
GRANT_DBA_OUTLN:= 'grant on commit refresh to outln identified by  
outln';
[...]

Many people are not aware that the GRANT command ("GRANT CONNECT TO  
SYS IDENTIFIED BY FD2008") can be used to change passwords in Oracle  
instead of using the "ALTER USER" command . It's a bad idea to  
hardcode passwords and it took only 1 year to fix this issue.

In most Oracle default installations the account OUTLN is locked but  
some security guidelines (e.g. Oracle Practical Security from  
Syngress) recommend to unlock the account OUTLN and set an invalid  
password (to avoid the error message "ORA-28000 account is locked").  
Following this advisory and setting an invalid password is opening a  
default user with default password with DBA privileges in the Oracle  
database (OUTLN/OUTLN) if a materialized view was created.

I found this vulnerability during the search for backdoors in Oracle  
databases for the Oracle malware report of our vulnerability scanner  
Repscan. I was looking for the strings like "grant dba to" and found  
that dbms_stats_internal is executing these commands in an internal  
package. In Oracle 9i you can find these strings using the grep  
command in $ORACLE_HOME/rdbms/admin because strings literals are not  
encrypted in wrapped PL/SQL 9i Code.
BTW: During this research I found also 3 Oracle procedures modifying  
the Oracle Audit-Table (Insert/Update/Delete rows from SYS.AUD$). I  
think procedures modifying the Audit-Log (especially delete and  
update) are a bad coding practice.

Patch Information
Apply the patches for Oracle CPU April 2008.

History
4-apr-2007 Oracle secalert was informed
15-apr-2008 Oracle published CPU April 2008 [DB13]
16-apr-2008 Advisory published

© 2008 by Red-Database-Security GmbH
http://www.red-database-security.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/