Vulnerability Note VU#193523

Oracle9i Application Server allows unauthenticated access to PL/SQL applications via alternate Database Access Descriptor

Overview

A vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS). By specifying the Database Access Descriptor (DAD) used to access a PL/SQL application, an attacker could gain unauthorized access to the application.

I. Description

NGSSoftware has released a paper titled Hackproofing Oracle Application Server that describes a number of security issues in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses the DAD substitution problem, where an attacker could bypass authentication by specifying which DAD to use to access a PL/SQL application.

Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. A DAD defines how a PL/SQL request connects to an application and is identified in the URL. For example:

http://ias-server/pls/DAD/application.procedure?parameter

A DAD can specify the credentials used to access an application, which may effectively grant anonymous (PUBLIC) access. If a DAD does not specify credentials, Apache will prompt the user and pass the credentials to the application using the PL/SQL module. Since the DAD is specified in the URL, an attacker can choose which DAD is used to access a particular application. By choosing a DAD that contains valid credentials, an attacker may be able to gain access to an application without being properly authenticated. In the case where one DAD provides PUBLIC access to one application and another DAD requires authentication for another application in the same database schema, an attacker can specify the PUBLIC DAD and gain unauthenticated access to the protected application.

The vulnerable PL/SQL module may also be used by Oracle9i Database and Oracle8i Database.

II. Impact

An unauthenticated remote attacker could gain access to an Oracle PL/SQL application. Depending on the capabilities of the application, the attacker could read, modify, or delete data.

III. Solution

Block or Restrict Access

Unauthenticated PUBLIC access to PL/SQL applications and procedures can be restricted using the exclusion_list parameter in the PL/SQL gateway configuration file, /Apache/modplsql/cfg/wdbsvr.app. This solution is described in Oracle Security Alert #28. For more information, read the section titled Protecting the PL/SQL Procedures Granted to PUBLIC in the Oracle iAS documentation under Using the PL/SQL Gateway.

Disable Vulnerable Service

Disable the PL/SQL service (modplsql or mod_plsql in Apache).

Systems Affected

Vendor	Status	Date Updated
Oracle	Vulnerable	5-Mar-2002

References

http://www.nextgenss.com/papers/hpoas.pdf
http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf

Credit

The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.

This document was written by Art Manion.

Other Information

Date Public	01/10/2002
Date First Published	03/01/2002 03:00:10 PM
Date Last Updated	03/15/2002
CERT Advisory
CVE-ID(s)
NVD-ID(s)
US-CERT Technical Alerts
Metric	5.94
Document Revision	41

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader