[NEWS] Oracle Extproc Buffer Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 07/28/03

  • Next message: SecuriTeam: "[EXPL] Microsoft SQL Server DoS Exploit Code"
    To: list@securiteam.com
    Date: 28 Jul 2003 15:49:29 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Get Thawte's New Step-by-Step SSL Guide for Apache.

    - - - - - - - - -

      Oracle Extproc Buffer Overflow


    Oracle's RDBMS, a leading database server package, supports stored
    packages and procedures using PL/SQL. These packages and procedures can be
    extended by allowing calls to be made to operating system libraries. Any
    library loaded in this way is done so by a process external to the main
    RDBMS, namely extproc. Extproc is vulnerable to a classic stack based
    buffer overflow. This can be exploited remotely by an attacker. No user ID
    or password is necessary.


    Vulnerable systems:
     * Oracle9i Database Release 2 and 1, 8i
    (Most OS platforms)

    Previously, NGSSoftware discovered a vulnerability in the Oracle package
    that allowed an attacker to force extproc to load any operating system
    library and execute any function. This attack did not require a user ID or
    password. Oracle took steps to resolve this security hole. By way of
    fixing the vulnerability, attempts to load libraries would be logged but
    denied unless the call came from the local machine. Remote attempts would
    be logged as just stated. However, this logging process is vulnerable to a
    classic stack based buffer overflow vulnerability. By supplying an overly
    long library name a stack based buffer is overflowed, overwriting the
    saved return address on the stack. When the vulnerable procedure returns
    control over the process' path of execution can be gained. As this does
    not require a user ID or password it must be stressed that this is a
    critical vulnerability. On Windows platforms Oracle typically runs in the
    security context of the LOCAL SYSTEM account and, as such, allows for a
    complete compromise of the server. On Unix-based systems extproc runs as
    the 'Oracle' user. As the 'Oracle' user typically is the owner of the
    software binaries and data files, an attacker exploiting this can
    completely subvert the integrity of the database software and data.

    Fix Information:
    NGSSoftware alerted Oracle to this vulnerability on 30th September 2002.
    Oracle has reviewed the code and created a patch that is available from:

    NGSSoftware advise Oracle database customers to review and install the
    patch as a matter of urgency.

    It is further recommend that Oracle DBAs have their network/firewall
    administrators ensure that the database server is protected from Internet
    sourced traffic.


    The information has been provided by <mailto:david@ngssoftware.com> David
    Litchfield and <mailto:chris@ngssoftware.com> Chris Anley.


    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com


    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Microsoft SQL Server DoS Exploit Code"