[NEWS] Oracle Database Link Buffer Overflow
From: SecuriTeam (support_at_securiteam.com)
To: firstname.lastname@example.org Date: 30 Apr 2003 11:11:15 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
In the US?
Contact Beyond Security at our new California office
housewarming rates on automated network vulnerability
scanning. We also welcome ISPs and other resellers!
Please contact us at: 323-882-8286 or email@example.com
- - - - - - - - -
Oracle Database Link Buffer Overflow
Oracle is the leader in the database market with a 54% market share lead
under ERP (Enterprise Resource Planning). The database server is
vulnerable to a remotely exploitable buffer overflow vulnerability. The
problem exists with database links; functionality that allows the querying
of one Oracle database server from another.
* All platforms; Oracle9i Database Release 2 and 1, 8i all releases, 8
all releases, 7.3.x
A classic stack based buffer overflow vulnerability exists in the Oracle
database server that can be set up for exploitation by providing an overly
long parameter for a connect string with the 'CREATE DATABASE LINK' query:
CREATE DATABASE LINK ngss
CONNECT TO hr
IDENTIFIED BY hr
By default, the 'CREATE DATABASE LINK' privilege is assigned to the
CONNECT role and as most Oracle accounts are assigned membership of this
role even low privileged accounts such as SCOTT and ADAMS can create
database links. By creating a specially crafted database link and then by
selecting from the link:
select * from table@ngss
The overflow can be triggered, overwriting the saved return address on the
stack. This allows an attacker to gain control of the Oracle process' path
of execution and permits the execution of arbitrary, user supplied code.
Any code supplied would run in the security context of the account running
the Oracle database server. On UNIX based systems this is typically the
'oracle' user and on Windows the local SYSTEM user. In the former, this
allows for a full compromise of the data and in the latter a full
compromise of the data and the operating system.
This is a high-risk vulnerability and as such should be patched as soon as
possible, after a suitable period of testing.
NGSSoftware alerted Oracle to this vulnerability on 30th September 2002.
Oracle has reviewed the code and created a patch that is available from:
NGSSoftware advise Oracle database customers to review and install the
patch as a matter of urgency.
The information has been provided by <mailto:firstname.lastname@example.org>
NGSSoftware Insight Security Research.
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: email@example.com
In order to subscribe to the mailing list, simply forward this email to: firstname.lastname@example.org
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.