[NEWS] Oracle Extproc Buffer Overflow

• Previous message: SecuriTeam: "[EXPL] RPC Overflow Exploit Code"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 28 Jul 2003 15:49:29 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

Get Thawte's New Step-by-Step SSL Guide for Apache.
http://ad.doubleclick.net/clk;5903117;8265118;i

- - - - - - - - -

  Oracle Extproc Buffer Overflow
------------------------------------------------------------------------

SUMMARY

Oracle's RDBMS, a leading database server package, supports stored
packages and procedures using PL/SQL. These packages and procedures can be
extended by allowing calls to be made to operating system libraries. Any
library loaded in this way is done so by a process external to the main
RDBMS, namely extproc. Extproc is vulnerable to a classic stack based
buffer overflow. This can be exploited remotely by an attacker. No user ID
or password is necessary.

DETAILS

Vulnerable systems:
 * Oracle9i Database Release 2 and 1, 8i
(Most OS platforms)

Previously, NGSSoftware discovered a vulnerability in the Oracle package
that allowed an attacker to force extproc to load any operating system
library and execute any function. This attack did not require a user ID or
password. Oracle took steps to resolve this security hole. By way of
fixing the vulnerability, attempts to load libraries would be logged but
denied unless the call came from the local machine. Remote attempts would
be logged as just stated. However, this logging process is vulnerable to a
classic stack based buffer overflow vulnerability. By supplying an overly
long library name a stack based buffer is overflowed, overwriting the
saved return address on the stack. When the vulnerable procedure returns
control over the process' path of execution can be gained. As this does
not require a user ID or password it must be stressed that this is a
critical vulnerability. On Windows platforms Oracle typically runs in the
security context of the LOCAL SYSTEM account and, as such, allows for a
complete compromise of the server. On Unix-based systems extproc runs as
the 'Oracle' user. As the 'Oracle' user typically is the owner of the
software binaries and data files, an attacker exploiting this can
completely subvert the integrity of the database software and data.

Fix Information:
NGSSoftware alerted Oracle to this vulnerability on 30th September 2002.
Oracle has reviewed the code and created a patch that is available from:
 <http://otn.oracle.com/deploy/security/pdf/2003alert57.pdf>
http://otn.oracle.com/deploy/security/pdf/2003alert57.pdf

NGSSoftware advise Oracle database customers to review and install the
patch as a matter of urgency.

It is further recommend that Oracle DBAs have their network/firewall
administrators ensure that the database server is protected from Internet
sourced traffic.

ADDITIONAL INFORMATION

The information has been provided by <mailto:david@ngssoftware.com> David
Litchfield and <mailto:chris@ngssoftware.com> Chris Anley.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[EXPL] RPC Overflow Exploit Code"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]