Vulnerability Note VU#932124

Oracle DBMS_EXPORT_EXTENSION package vulnerable to SQL injection

Oracle extensions are used to create customized Oracle database constructs. An indextype is an Oracle extension that allows users to create specialized indexes on an Oracle database. To create a new indextype, the ODCIIndex Interface must be implemented, meaning that certain methods specified in that interface must be defined. The ODCIIndexGetMetadata(...) routine is one such method in the ODCIIndex Interface. When the ODCIIndex Interface is implemented for a new indextype, the ODCIIndexGetMetadata(...)routine is used to specify how metadata for that indextype should be handled.

Oracle DBMS_EXPORT_EXTENSION

DBMS_EXPORT_EXTENSION is a built-in Oracle package used to import and export information in an Oracle Database. The DBMS_EXPORT_EXTENSION package implements the ODCIIndex Interface ODCIIndexGetMetadata(...) routine. Note that this package is owned by SYSDBA, but is accessible to the PUBLIC by default.

The Problem

The DBMS_EXPORT_EXTENSION package fails to properly sanitize user-controlled input. Specifically, if the GET_DOMAIN_INDEX_METADATA(...)routine is executed with the ODCIIndexGetMetadata(...)routine and attacker-supplied SQL commands, the SQL commands will be executed with SYSDBA privileges.

Based on research into public information, we believe that this issue is Oracle vuln# DB06 in the Oracle Critical Patch Update for July 2006.

Note that exploit code for this issue is publicly available.

II. Impact

Oracle has released the Oracle Critical Patch Update (CPU) for July 2006. It is unclear from the Oracle documentation whether this issue is addressed by this CPU. Public reports indicate that this issue has been addressed by this CPU, but this has not been confirmed.
Until a patch for this issue can be applied, the following actions may reduce the chances of exploitation:

Restrict access to Oracle

Only known and trusted users should be allowed access to Oracle. Additionally, user accounts should only be granted the fewest privileges needed to perform necessary tasks.

Change login credentials for default Oracle accounts

Oracle creates numerous default accounts when it is installed. Upon installation, accounts that are not needed should be disabled and the login credentials for needed accounts should be changed.

Systems Affected

http://www.juniper.net/security/auto/vulnerabilities/vuln3319.html
http://secunia.com/advisories/19860
http://www.securityfocus.com/bid/17699
http://www.red-database-security.com/exploits/oracle-sql-injection-oracle-dbms_export_extension.html
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2006.html
http://www.red-database-security.com/advisory/oracle_cpu_jul_2006.html

Credit

This vulnerability was reported by David Litchfield of NGS Software.

This document was written by Jeff Gennari and Stephen Rhoton.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.