[NEWS] Oracle9i Application Server Format String Vulnerability

• Previous message: support@securiteam.com: "[NEWS] Oracle TZ_OFFSET Remote System Buffer Overrun"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: support@securiteam.com
To: list@securiteam.com
Date: 17 Feb 2003 22:16:14 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

Beyond Security would like to welcome Tiscali World Online
to our service provider team.
For more info on their service offering IP-Secure,
please visit http://www.worldonline.co.za/services/work_ip.asp
- - - - - - - - -

  Oracle9i Application Server Format String Vulnerability
------------------------------------------------------------------------

SUMMARY

Oracle's 9i Application Server offers a highly functional web server
designed to seamlessly integrate with an Oracle backend database server.
Based on Apache the server offers many environments for web-based
applications such as Java/JSP, PL/SQL, Perl, and FastCGI. With their
latest release of the Application Server, 9.0.2, Oracle has added support
for WebDAV, Web Distributed Authoring, and Versioning, that turns the Web
into a file sharing system. A format string vulnerability in the DAV
module allows remote attackers to cause it to execute arbitrary code.

DETAILS

Vulnerable systems:
 * All platforms; Oracle9i Application Server Release 9.0.2

DAV is turned on by default. Whilst this is bad on itself, as attackers
can anonymously upload files to the server, an attacker can exploit a
format string bug in the one of the logging functions. If an attacker uses
the COPY method and supplies a destination URI that uses a different
scheme or port then a 502 Bad Gateway response is returned. This is logged
and in doing so the format string can be exploited. Although the Apache
mod_dav module is not vulnerable by itself, the vulnerable code is there -
it is just not ever executed. Oracle has modified the mod_dav module and
changed it so bad gateway responses are logged - and thus they are
vulnerable. Looking at the mod_dav source

From mod_dav.c revision 1.157
.
.
lookup = dav_lookup_uri(dest, r);
if (lookup.rnew == NULL)
{
      if (lookup.err.status == HTTP_BAD_REQUEST)
      {
            ap_log_rerror(APLOG_MARK, APLOG_ERR | APLOG_NOERRNO,
r,lookup.err.desc);
            return HTTP_BAD_REQUEST;
      }
      return dav_error_response(r, lookup.err.status, lookup.err.desc);
}
.
.

This code calls the dav_lookup_uri() function in dav_util.c. From
dav_util.c revision 1.84

.
dav_lookup_result dav_lookup_uri(const char *uri, request_rec * r)
{
.
.
if (strcasecmp(comp.scheme, scheme) != 0 || comp.port != port)
{
      result.err.status = HTTP_BAD_GATEWAY;
      result.err.desc = ap_psprintf(r->pool,
      "Destination URI refers to different "
      "scheme or port (%s://hostname:%d)\n"
      "(want: %s://hostname:%d)",
      comp.scheme ? comp.scheme : scheme,
      comp.port ? comp.port : port,
      scheme, port);

      return result;

.
.
}

When dav_lookup_uri() returns to mod_dav.c the format strings occurs

.
lookup = dav_lookup_uri(dest, r);
if (lookup.rnew == NULL)
{
      if (lookup.err.status == HTTP_BAD_REQUEST)
      {
      // THIS IS THE FIRST FORMAT STRING VULNERABILITY
      ap_log_rerror(APLOG_MARK, APLOG_ERR | APLOG_NOERRNO,
r,lookup.err.desc);
.
.
}

Of course the code should have read

ap_log_rerror(APLOG_MARK, APLOG_ERR | APLOG_NOERRNO,
r,"%s",lookup.err.desc);

To not be vulnerable.

By constructing a specially formed format string and sending to the server
an attacker can overwrite arbitrary address with arbitrary values which
can allow an attacker to gain control of the web server. To do this they
could overwrite a saved return address on the stack, an exception handler,
or pointer to a function with an address that points to a buffer that
contains the arbitrary code to execute.

Fix Information:
NGSSoftware alerted Oracle to this vulnerability on 24 September 2002.
Oracle has developed a patch that is available from
 <http://otn.oracle.com/deploy/security/pdf/2003alert52.pdf>
http://otn.oracle.com/deploy/security/pdf/2003alert52.pdf

ADDITIONAL INFORMATION

The information has been provided by <mailto:nisr@nextgenss.com>
NGSSoftware Insight Security Research.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Next message: support@securiteam.com: "[NEWS] Oracle TO_TIMESTAMP_TZ Remote System Buffer Overrun"
• Previous message: support@securiteam.com: "[NEWS] Oracle TZ_OFFSET Remote System Buffer Overrun"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]