Vulnerability Note VU#611776

Oracle9i Application Server PL/SQL Gateway web administration interface uses null authentication by default

Overview

A vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle 9i Application Server (iAS). In its default configuration, the PL/SQL module grants unauthenticated access to the PL/SQL gateway web-based administration interface.

I. Description

NGSSoftware has released a paper titled Hackproofing Oracle Application Server that describes a number of security issues in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses a default configuration vulnerability in which access to the PL/SQL gateway administration web interface is not authenticated.

Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. The PL/SQL module provides a web-based administration interface to configure Database Access Descriptors (DAD) and cache settings. A DAD describes how a PL/SQL request connects to an application and can specify credentials or other authentication information. By default no (null) authentication is performed on requests for the administration web pages. Any user who is able to access the web server can administer the PL/SQL gateway.

The vulnerable PL/SQL module may also be used by Oracle9i Database and Oracle8i Database.

II. Impact

An unauthenticated, remote intruder could modify DAD and cache settings. By modifying, creating, or deleting DADs, an intruder could gain access to PL/SQL applications or deny service legitimate users. Also, access to the PL/SQL gateway administration web interface exposes two buffer overflow vulnerabilities: one in the DAD password field [VU#659043] and a second in the cache directory name [VU#923395].

III. Solution

Restrict Access

Access to the PL/SQL gateway administration web pages can be restricted by specifying authorized user names and connect strings or an administrative Database Access Descriptor (DAD) in the PL/SQL gateway configuration file, /Apache/modplsql/cfg/wdbsvr.app. For more information, read the section titled Protecting the Administration pages in the Oracle iAS documentation under Using the PL/SQL Gateway.

Change Path to Administrative Interface

The path to the administration web pages can be configured in the the PL/SQL gateway configuration file, /Apache/modplsql/cfg/wdbsvr.app. While changing the path may make it more difficult, it does not prevent an intruder from accessing the administration web pages. To protect the administration web pages, configure the PL/SQL gateway to require authentication as noted above under Restrict Access.

Disable Vulnerable Service

Disable the PL/SQL service (modplsql or mod_plsql in Apache).

Systems Affected

Vendor	Status	Date Notified	Date Updated
Oracle Corporation	Vulnerable	13-Mar-2002

References

VU#659043
VU#923395
http://www.kb.cert.org/vuls/id/659043
http://www.kb.cert.org/vuls/id/923395
http://www.nextgenss.com/papers/hpoas.pdf
http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf
http://www.securityfocus.com/bid/4292

Credit

This issue was reported by Sanjay Patel. The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.

This document was written by Art Manion.

Other Information

Date Public:	2002-01-10
Date First Published:	2002-03-13
Date Last Updated:	2003-07-02
CERT Advisory:
CVE-ID(s):	CAN-2002-0561
NVD-ID(s):	CAN-2002-0561
US-CERT Technical Alerts:
Metric:	6.04
Document Revision:	26

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader