Oracle Trigger Abuse (#NISR2122004I)

From: NGSSoftware Insight Security Research (nisr_at_NEXTGENSS.COM)
Date: 12/23/04

  • Next message: NGSSoftware Insight Security Research: "Oracle Character Conversion Bugs (#NISR2122004G)"
    Date:         Thu, 23 Dec 2004 16:29:32 -0000
    To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
    
    

    NGSSoftware Insight Security Research Advisory

    Name: Oracle 10g/9i Trigger Abuse
    Systems Affected: Oracle 10g/9i on all operating systems
    Severity: High risk
    Vendor URL: http://www.oracle.com/
    Author: David Litchfield [ davidl at ngssoftware.com ]
    Relates to: http://www.nextgenss.com/advisories/oracle-01.txt
    Date of Public Advisory: 23rd December 2004
    Advisory number: #NISR2122004I
    Advisory URL: http://www.ngssoftware.com/advisories/oracle23122004I.txt

    Description
    ***********
    Database triggers exist to help maintain data integrity and perform certain
    actions when a table's data is modified. Many of the default triggers in
    Oracle can be abused to gain elevated privileges.

    Details
    *******

    Triggers are written in PL/SQL and execute with the privileges of the
    definer/owner.

    The trigger SDO_CMT_CBK_TRIG, owned by MDSYS, fires when a DELETE is
    performed on the SDO_TXN_IDX_INSERTS table also owned by MDSYS. PUBLIC has
    the SELECT, INSERT, UPDATE and DELETE object privileges on this table.
    Consequently, anyone can cause the SDO_CMT_CBK_TRIG trigger to fire by
    deleting a row from the table. If we examine the text of the trigger we can
    see that, before the DELETE actually occurs, a list of functions are
    selected from the SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE tables and
    then these functions are executed. PUBLIC has no object privileges set for
    either of these tables so they can not insert their own funtion name.
    However, the PRVT_CMT_CBK package owned by MDSYS has two procedures,
    CCBKAPPLROWTRIG and EXEC_CBK_FN_DML, that take as their parameters a schema
    and function name which are then inserted into the SDO_CMT_DBK_FN_TABLE and
    SDO_CMT_CBK_DML_TABLE tables. PUBLIC has the EXECUTE permission on the
    PRVT_CMT_CBK package and, as it has not been defined with the 'AUTHID
    CURRENT_USER' keyword, the package executes using the rights of MDSYS, the
    definer, and not the invoker. As a result of this anyone can indirectly
    insert function names into the SDO_CMT_DBK_FN_TABLE and
    SDO_CMT_CBK_DML_TABLE tables. Thus when a DELETE occurs on
    SDO_TXN_IDX_INSERTS anyone can influence what actions the SDO_CMT_CBK_TRIG
    trigger takes - in other words, anyone can get the trigger to execute an
    arbitrary function. What is more, this function, as it is being executed
    from the trigger will run with the privileges of MDSYS and an attacker can
    exploit this to gain elevated privileges.

    The MDSYS.SDO_GEOM_TRIG_INS1 is vulnerable to SQL injection on both 9i and
    10g. The trigger executes the following

    ..
    ..
    EXECUTE IMMEDIATE
    'SELECT user FROM dual' into tname;
    stmt := 'SELECT count(*) FROM SDO_GEOM_METADATA_TABLE ' ||
    'WHERE sdo_owner = ''' || tname || ''' ' ||
    ' AND sdo_table_name = ''' || :n.table_name || ''' '||
    ' AND sdo_column_name = ''' || :n.column_name || ''' ';
    ..
    ..

    when an INSERT is performed on MDSYS.USER_SDO_GEOM_METADATA. The
    :new.table_name and :new.column_name can be influenced by the user and SQL
    injected. PUBLIC has the permissions to INSERT into this table. As such the
    trigger can be abused to gain MDSYS privileges - a DBA.

    The MDSYS.SDO_LRS_TRIG_INS trigger fires when an INSERT occurs on the
    MDSYS.USER_SDO_LRS_METADATA view. PUBLIC can insert into this view and so
    cause the trigger to fire. This trigger is vulnerable to SQL injection. Both
    Oracle 9i and 10g are affected. It executes

    ..
    ..
    stmt := 'SELECT count(*) FROM SDO_LRS_METADATA_TABLE ' ||
    ' WHERE sdo_owner = ''' || UPPER(user_name) || ''' ' ||
    ' AND sdo_table_name = ''' || UPPER(:n.table_name) || ''' ' ||
    ' AND sdo_column_name = ''' || UPPER(:n.column_name) || ''' ';
    EXECUTE IMMEDIATE stmt INTO vcount;
    ..
    ..

    and :new.table_name and :new.column_name are user supplied in the insert
    statement. This is where an attacker can insert SQL.

    Fix Information
    ***************
    A patch (#68) was released for this problem by Oracle. See
    http://metalink.oracle.com/ for more details. NGSSQuirreL for Oracle
    (http://www.nextgenss.com/squirrelora.htm), can be used to assess whether
    your Oracle servers are vulnerable to this.

    About NGSSoftware
    *****************
    NGSSoftware design, research and develop intelligent, advanced application
    security assessment scanners. Based in the United Kingdom, NGSSoftware have
    offices in the South of London and the East Coast of Scotland. NGSSoftware's
    sister company NGSConsulting, offers best of breed security consulting
    services, specialising in application, host and network security
    assessments.

    http://www.ngssoftware.com/

    Telephone +44 208 401 0070
    Fax +44 208 401 0076

    enquiries@ngssoftware.com

    --
    Editor's Note: The 43rd Most Powerful Person in Networking says...
    Register today to take the TruSecure ICSA exam by 12/31/04  at
    <http://www.2test.com> ,  use promo code "CT1204" and you will pay just
    $221.25 US Dollars for domestic exam delivery and  $296.25 US Dollars
    for international delivery.
    Visit <https://ticsa.trusecure.com>  for complete details regarding the
    TICSA credential and to take the free sample exam.
    --
    

  • Next message: NGSSoftware Insight Security Research: "Oracle Character Conversion Bugs (#NISR2122004G)"