[VulnWatch] [AppSecInc Team SHATTER Security Advisory] Multiple SQL Injection vulnerabilities in DBMS_METADATA package

From: Team SHATTER (shatter_at_appsecinc.com)
Date: 04/18/05

  • Next message: Team SHATTER: "[VulnWatch] [AppSecInc Team SHATTER Security Advisory] SQL Injection in ALTER_MANUALLOG_CHANGE_SOURCE procedure"
    Date: Mon, 18 Apr 2005 15:07:23 -0400
    To: bugtraq@securityfocus.com
    
    

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Multiple SQL Injection vulnerabilities in DBMS_METADATA package

    AppSecInc Team SHATTER Security Advisory
    http://www.appsecinc.com/resources/alerts/oracle/2005-03.html
    April 18, 2005

    Affected Versions: Oracle Database Server versions 9i and 10g

    Risk Level: High

    Credits: This vulnerability was discovered and researched by Esteban
    Martínez Fayó of Argeniss for Application Security Inc.

    Details:
    The OBJECT_TYPE parameter -- used in various procedures of the
    DBMS_METADATA package -- is vulnerable to SQL injection. Although this
    package executes with the privileges of the calling user, it internally
    uses another package that executes the injected SQL with the privileges
    of the SYS user thereby allowing an attacker to gain DBA privileges. By
    default PUBLIC has EXECUTE privilege on DBMS_METADATA.

    Impact:
    Any low privileged database user can execute functions with DBA
    privileges. Users with privilges to create or modify a function can
    inject a user-defined function in the vulnerable procedure and thus
    execute SQL statements with DBA privileges.

    Workaround:
    Revoke Execute privilege on the vulnerable package.

    Vendor Status:
    Vendor was contacted and a patch was released.

    Fix:
    Apply Oracle Critical Patch Update April 2005 available at
    http://metalink.oracle.com

    Links:
    Application Security, Inc advisory:
    http://www.appsecinc.com/resources/alerts/oracle/2005-03.html
    Oracle security alert:
    http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf
    Advanced SQL Injection in Oracle databases presentation:
    http://www.argeniss.com/research.html

    - --
    _____________________________________________
    Application Security, Inc.
    www.appsecinc.com
    AppSecInc is the leading provider of database security solutions for the
    enterprise. AppSecInc products proactively secure enterprise
    applications at more than 300 organizations around the world by
    discovering, assessing, and protecting the database against rapidly
    changing security threats. By securing data at its source, we enable
    organizations to more confidently extend their business with customers,
    partners and suppliers. Our security experts, combined with our strong
    support team, deliver up-to-date application safeguards that minimize
    risk and eliminate its impact on business.

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.0 (MingW32)

    iD8DBQFCZAVr/0w1dSVRt4URAmqXAKC1XublBC2knts8TL9PSftz2oIwEgCePvz5
    miyRWVoxfyHaMOryDqxfi4E=
    =veNk
    -----END PGP SIGNATURE-----


  • Next message: Team SHATTER: "[VulnWatch] [AppSecInc Team SHATTER Security Advisory] SQL Injection in ALTER_MANUALLOG_CHANGE_SOURCE procedure"

    Relevant Pages