Vulnerability Note VU#805915

Oracle9i Application Server Apache PL/SQL module does not properly handle HTTP Authorization header

Overview

A vulnerability exists in the way the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS) handles HTTP Authorization headers. This vulnerability could allow an unauthenticated remote attacker to crash the Apache service.

I. Description

NGSSoftware has released Insight Security Research Advisory #NISR06022002B that describes a number of vulnerabilities in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses a denial-of-service vulnerability triggered by a malformed HTTP Authorization request.

Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. The PL/SQL module handles authentication requests for various elements of Oracle iAS, such as stored procedures and Database Access Descriptors (DAD). If necessary, the PL/SQL module will prompt for credentials using the Authorization mechanism of the HTTP protocol. Section 14.8 of RFC 2616 describes HTTP Authorization and RFC 2617 describes the Basic and Digest HTTP Authentication schemes. Both server challenges and client requests use a token to determine what type of Authentication scheme (auth-scheme) to use. If the PL/SQL module receives a malformed HTTP Authorization request that does not contain an Authentication type (auth-scheme) token, the Apache process will crash, denying service to legitimate users.

The vulnerable PL/SQL module may also be used by Oracle9i Database and Oracle8i Database.

II. Impact

An unauthenticated remote attacker can crash the Apache service.

III. Solution

Apply Patch

Apply the appropriate patch referenced in Oracle Security Alert #28.

Block or Restrict Access

Monitor and/or restrict access to the Apache service (typically 80/tcp). It may be possible to use TCP Wrapper or similar technology to provide improved access control and logging. Additionally, an application layer firewall or Intrusion Detection System (IDS) may be able to filter requests made to Apache. Note that these workarounds are designed to limit access and detect exploit attempts. These workarounds do not prevent exploitation of this vulnerability.

Disable Vulnerable Service

Disable the vulnerable service (modplsql or mod_plsql in Apache).

Systems Affected

Vendor	Status	Date Notified	Date Updated
Oracle	Vulnerable	13-Mar-2002

References

http://www.nextgenss.com/advisories/oraplsbos.txt
http://www.nextgenss.com/papers/hpoas.pdf
http://www.securityfocus.com/bid/4037
http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf
http://otn.oracle.com/tech/pl_sql/content.html
http://metalink.oracle.com/
http://www.ietf.org/rfc/rfc2616.txt
http://www.ietf.org/rfc/rfc2617.txt

Credit

The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.

This document was written by Art Manion.

Other Information

Date Public:	2002-02-06
Date First Published:	2002-02-25
Date Last Updated:	2002-03-15
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	3.26
Document Revision:	46

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader