Vulnerability Note VU#313280

Oracle9i Application Server Apache PL/SQL module vulnerable to buffer overflow via HTTP Location header

Original Release date: 12 Mar 2002 | Last revised: 15 Mar 2002

Overview

A buffer overflow vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS). This vulnerability could allow an unauthenticated remote attacker to cause a denial of service or execute arbitrary code on the system with the privileges of the Apache process.

Description

NGSSoftware has released a paper titled Hackproofing Oracle Application Server that describes a number of security issues in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses a buffer overflow that occurs in the HTTP Location header sent in response to a request for a help page.

Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. The PL/SQL module also provides the ability to remotely administer Database Access Descriptors (DAD) and access help pages. While access to the DADs is restricted by username and password, access to the help pages is not and they can be accessed by any user. A help page can be requested through its direct URL, as demonstrated in the following example:

http://ias-server/pls/DAD/help/helppage.html

A buffer overflow vulnerability exists in the code that handles a request for a help page. This vulnerability is documented in VU#500203. A help page can also be requested without specifying the DAD, as shown in this example:

http://ias-server/pls/help/helppage.html

Upon receiving this request, the PL/SQL module responds with an HTTP Location header directing the client to a URL containing the default DAD, as in the first example above. The buffer overflow described in this document occurs in the HTTP Location header parameter. A malicious URL that is reproduced in the HTTP Location header could trigger the buffer overflow, thus crashing the Apache process or executing code of the attacker's choice.

The vulnerable PL/SQL module may also be used by Oracle9i Database and Oracle8i Database.

Impact

An unauthenticated remote attacker could cause a denial of service or execute arbitrary code on the system with the privileges of the Apache process. Since the Apache service typically runs with SYSTEM privileges on Windows NT and Windows 2000, an attacker may be able to gain complete control of the system.

Solution

Apply Patch
Apply the patch referenced in Oracle Security Alert #28.


Disable Vulnerable Service

Disable the PL/SQL service (modplsql or mod_plsql in Apache).

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
OracleAffected-12 Mar 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.

This document was written by Art Manion.

Other Information

  • CVE IDs: Unknown
  • Date Public: 10 Jan 2002
  • Date First Published: 12 Mar 2002
  • Date Last Updated: 15 Mar 2002
  • Severity Metric: 7.18
  • Document Revision: 21

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.