Oracle Trace Collection Security Vulnerability

From: Oracle Security Alerts (
Date: 10/24/01

Message-ID: <>
Date: Wed, 24 Oct 2001 13:02:18 -0700
From: Oracle Security Alerts <>
Subject: Oracle Trace Collection Security Vulnerability

Security Alert #19
Reference Date: 10/18/01

Oracle Trace Collection Security Vulnerability

A potential security vulnerability has been discovered in the handling
of the environment variable, ORACLE_HOME. A buffer overflow is caused
when the Oracle binary, otrcrep, translates the environment variable,
ORACLE_HOME, into a string of 240 or more bytes. The Oracle binary
otrcrep runs with the SETUID oracle privileges in the operating system
DBA group. The buffer overflow may be exploited by a local user to force
overwriting of stack variables in shared memory including the return
memory address(es) and thereby execute arbitrary (or specific,
malicious) code with the privileges of the oracle user and/or the DBA
group privileges.

All Oracle database server releases (8.0.x, 8.1.x and 9.0.1)

All Unix platforms

If the ORACLE_HOME environment variable is being translated into a
string of 240 or more bytes, disable Oracle Trace by setting its control
parameter in init<SID>.ora as follows:


Change the file permissions on all of the Oracle Trace executables as
% chmod -s otrccol otrccref otrcfmt otrcrep
% chmod 751 otrccol otrccref otrcfmt otrcrep

The potential security vulnerability will be code-fixed in the next
release of the Oracle database server which is Oracle9i, Release 2,
only. All other releases of the Oracle database (8.0.x, 8.1.x and 9.0.1)
must use follow the workarounds specified above to circumvent the
potential security vulnerability.

Oracle wishes to thank Juan Manuel Pascual EscribĂ for discovering these
vulnerabilities and promptly bringing them to Oracle's attention.

Relevant Pages