lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 16 Jun 2014 08:58:13 +0200
From: Security Explorations <>
Subject: [FD] [SE-2014-01] Security vulnerabilities in Oracle Database Java

Hello All,

Security Explorations discovered multiple security issues in the 
of a Java VM embedded in Oracle Database software [1].

Discovered security issues violate many "Secure Coding Guidelines for the
Java Programming Language" [2]. Most of them demonstrate a well known 
related to Java SE security. Among a total of 20 weaknesses discovered, 
are issues that allow to create a specific Java security bypass condition
or that facilitate the execution of arbitrary Java code on Oracle Database
server without proper privileges.

We developed reliable Proof of Concept codes for all of the issues found.
This includes 8 exploit codes implementing 3 different privilege elevation
techniques for gaining administrator role in a target database environment.

A malicious user with a bare minimum privilege required to connect and login
to Oracle Database (with "CREATE SESSION" privilege only) can successfully
compromise the security of the software that according to Oracle CEO "hasn't
been broken into for a couple of decades by anybody" and that is "so secure,
there are people that complain" [3].

The following versions of Oracle Database software were verified to be
vulnerable to all 20 identified weaknesses:
- Oracle Database 11g Release 2 ( for Microsoft Windows x64
- Oracle Database 11g Release 2 ( Patch Bundle 18590877 for
   Microsoft Windows x64
- Oracle Database 12c Release 1 ( for Microsoft Windows x64
- Oracle Database 12c Release 1 ( Bundle Patch 18724015 for
   Microsoft Windows x64

Our vulnerability report containing brief technical details of all 
issues and exploitation techniques along with corresponding Proof of Concept
codes were sent to Oracle today.

It's been almost 2 years since Java Reflection API issues were brought 
to the
public attention. Regardless of that, simple instances of these issues 
are still
present in Oracle products other than Java SE.

This is probably a good moment to remind what we said almost a year ago 
at the
time of wrapping up our Java SE security research [4]:

"If Oracle had any Software Security Assurance procedures adopted for 
Java SE,
most of simple Reflection API flaws along with a known, 10+ years old attack
should have been eliminated prior to Java SE 7 release. This didn't happen,
thus it is reasonable to assume that Oracle's security policies and 
are either not worth much or their implementation is far from perfect. That
thought alone should catch attention of Oracle customers not necessarily
relying on Java SE, but rather on other Oracle products, which were 
likely the
subject to the very same, questionable Software Security Assurance policies
and procedures as Java SE 7".

Thank you.

Best Regards,
Adam Gowdiak

Security Explorations
"We bring security research to the new level"

[1] Oracle Database
[2] Secure Coding Guidelines for the Java Programming Language, Version 4.0
[3] Oracle's Ellison downplays threat of NSA database snooping
[4] [SE-2012-01] New Reflection API affected by a known 10+ years old attack

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists