[VulnWatch] [AppSecInc Team SHATTER Security Advisory] Denial of Service in Oracle interMedia
From: Team SHATTER (shatter_at_appsecinc.com)
Date: Mon, 18 Apr 2005 15:01:42 -0400 To: firstname.lastname@example.org
-----BEGIN PGP SIGNED MESSAGE-----
Denial of Service in Oracle interMedia
AppSecInc Team SHATTER Security Advisory
April 18, 2005
Affected versions: Oracle Database Server versions 9i and 10g
Risk level: Medium
Credits: This vulnerability was discovered and researched by Esteban
Martínez Fayó of Argeniss for Application Security Inc.
Within the Oracle interMedia system, two types (ORDImage and ORDDoc)
have a vulnerability that can cause a Denial of Service condition. When
trying to load a specially constructed file, or when setting specially
constructed data to object's property, a Denial of service can be
triggered making Oracle server process consume 100% CPU usage. The
service needs to be restarted to resume normal operation.
This vulnerability can be exploited remotely by supplying a specially
constructed file to an application that uses the vulnerable objects to
process the file in the database server.
By default PUBLIC has execute permission on these objects so any Oracle
database user can exploit this vulnerability. Exploitation of this
vulnerability will allow an attacker to cause a DOS (Denial of service).
Vendor was contacted and a patch was released.
Apply Oracle Critical Patch Update April 2005 available at
Application Security, Inc advisory:
Oracle security alert:
Application Security, Inc.
AppSecInc is the leading provider of database security solutions for the
enterprise. AppSecInc products proactively secure enterprise
applications at more than 300 organizations around the world by
discovering, assessing, and protecting the database against rapidly
changing security threats. By securing data at its source, we enable
organizations to more confidently extend their business with customers,
partners and suppliers. Our security experts, combined with our strong
support team, deliver up-to-date application safeguards that minimize
risk and eliminate its impact on business.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)
-----END PGP SIGNATURE-----