Vulnerability Note VU#193523
Oracle9i Application Server allows unauthenticated access to PL/SQL applications via alternate Database Access Descriptor
A vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS). By specifying the Database Access Descriptor (DAD) used to access a PL/SQL application, an attacker could gain unauthorized access to the application.
NGSSoftware has released a paper titled Hackproofing Oracle Application Server that describes a number of security issues in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses the DAD substitution problem, where an attacker could bypass authentication by specifying which DAD to use to access a PL/SQL application.
Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. A DAD defines how a PL/SQL request connects to an application and is identified in the URL. For example:
A DAD can specify the credentials used to access an application, which may effectively grant anonymous (PUBLIC) access. If a DAD does not specify credentials, Apache will prompt the user and pass the credentials to the application using the PL/SQL module. Since the DAD is specified in the URL, an attacker can choose which DAD is used to access a particular application. By choosing a DAD that contains valid credentials, an attacker may be able to gain access to an application without being properly authenticated. In the case where one DAD provides PUBLIC access to one application and another DAD requires authentication for another application in the same database schema, an attacker can specify the PUBLIC DAD and gain unauthenticated access to the protected application.
An unauthenticated remote attacker could gain access to an Oracle PL/SQL application. Depending on the capabilities of the application, the attacker could read, modify, or delete data.
Block or Restrict Access
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Oracle||Affected||02 Mar 2002||05 Mar 2002|
CVSS Metrics (Learn More)
The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.
This document was written by Art Manion.
- CVE IDs: Unknown
- Date Public: 10 Jan 2002
- Date First Published: 01 Mar 2002
- Date Last Updated: 15 Mar 2002
- Severity Metric: 5.94
- Document Revision: 41
If you have feedback, comments, or additional information about this vulnerability, please send us email.