Vulnerability Note VU#997403

Oracle Reports Server Reports Web Cartridge (RWCGI60) vulnerable to buffer overflow via database name parameter

Overview

A buffer overflow vulnerability in Oracle Reports Server 6i could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Reports Server process.

I. Description

Oracle Reports Server is a component of Oracle Application Server that handles client requests for reports from multiple data sources. Oracle Reports Server is capable of accepting requests and delivering reports over the web using a Reports Web Cartridge (RWCGI60). RWCGI60 is a CGI program that translates and delivers information between the Oracle HTTP Server and the Oracle Reports Server. According to a report by NGSSoftware, RWCGI60 is vulnerable to a buffer overflow via an HTTP request containing a specially crafted database name parameter.

According to Oracle Security Alert #35, Oracle Reports Server 6.0.8.18.0 and earlier are vulnerable, and Oracle9i Application Server 1.0.x includes a vulnerable version of Oracle Reports Server.

II. Impact

An unauthenticated, remote attacker could execute arbitrary code or cause a denial of service on a vulnerable system. By default, the Oracle Reports stand-alone server runs as SYSTEM on Windows NT and Windows 2000 systems.

III. Solution

Apply a Patch

Oracle Security Alert #35 provides information on patches that address this vulnerability.

Restrict Access

Where possible, limit access to trusted users, hosts, and networks.

Disable Oracle Reports Services

If your site does not use the Oracle Reports Services, disable it.

Disable RWCGI60

If you are able to use other components of Oracle Reports Services to process reports via HTTP, do not use RWCGI60.

Systems Affected

Vendor	Status	Date Updated
Oracle	Vulnerable	6-Jun-2002

References

http://technet.oracle.com/deploy/security/pdf/reports6i_alert.pdf
http://www.nextgenss.com/vna/ora-reports.txt
http://www.nextgenss.com/advisories/orarep.txt
http://www.securityfocus.com/bid/4848
http://www.iss.net/security_center/static/9289.php

Credit

The CERT/CC thanks David Litchfield of NGSSoftware for information used in this document.

This document was written by Art Manion.

Other Information

Date Public	05/27/2002
Date First Published	06/04/2002 03:58:10 PM
Date Last Updated	11/15/2002
CERT Advisory
CVE Name	CAN-2002-0947
Metric	11.66
Document Revision	47

If you have feedback, comments, or additional information about this vulnerability, please send us email.