Vulnerability Note VU#193523

Oracle9i Application Server allows unauthenticated access to PL/SQL applications via alternate Database Access Descriptor

Original Release date: 01 Mar 2002 | Last revised: 15 Mar 2002

Overview

A vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS). By specifying the Database Access Descriptor (DAD) used to access a PL/SQL application, an attacker could gain unauthorized access to the application.

Description

NGSSoftware has released a paper titled Hackproofing Oracle Application Server that describes a number of security issues in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses the DAD substitution problem, where an attacker could bypass authentication by specifying which DAD to use to access a PL/SQL application.

Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. A DAD defines how a PL/SQL request connects to an application and is identified in the URL. For example:

http://ias-server/pls/DAD/application.procedure?parameter

A DAD can specify the credentials used to access an application, which may effectively grant anonymous (PUBLIC) access. If a DAD does not specify credentials, Apache will prompt the user and pass the credentials to the application using the PL/SQL module. Since the DAD is specified in the URL, an attacker can choose which DAD is used to access a particular application. By choosing a DAD that contains valid credentials, an attacker may be able to gain access to an application without being properly authenticated. In the case where one DAD provides PUBLIC access to one application and another DAD requires authentication for another application in the same database schema, an attacker can specify the PUBLIC DAD and gain unauthenticated access to the protected application.

The vulnerable PL/SQL module may also be used by Oracle9i Database and Oracle8i Database.

Impact

An unauthenticated remote attacker could gain access to an Oracle PL/SQL application. Depending on the capabilities of the application, the attacker could read, modify, or delete data.

Solution

Block or Restrict Access
Unauthenticated PUBLIC access to PL/SQL applications and procedures can be restricted using the exclusion_list parameter in the PL/SQL gateway configuration file, /Apache/modplsql/cfg/wdbsvr.app. This solution is described in Oracle Security Alert #28. For more information, read the section titled Protecting the PL/SQL Procedures Granted to PUBLIC in the Oracle iAS documentation under Using the PL/SQL Gateway.


Disable Vulnerable Service

Disable the PL/SQL service (modplsql or mod_plsql in Apache).

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
OracleAffected02 Mar 200205 Mar 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.

This document was written by Art Manion.

Other Information

  • CVE IDs: Unknown
  • Date Public: 10 Jan 2002
  • Date First Published: 01 Mar 2002
  • Date Last Updated: 15 Mar 2002
  • Severity Metric: 5.94
  • Document Revision: 41

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.