SkipNavigation
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric



 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

 

Vulnerability Note VU#932124

Oracle DBMS_EXPORT_EXTENSION package vulnerable to SQL injection

Overview

A vulnerability in Oracle PL/SQL Export Extensions may allow an attacker to modify privileged database information.

I. Description

Oracle Extensions, ODCIIndex Interface, and ODCIIndexGetMetadata

Oracle extensions are used to create customized Oracle database constructs. An indextype is an Oracle extension that allows users to create specialized indexes on an Oracle database. To create a new indextype, the ODCIIndex Interface must be implemented, meaning that certain methods specified in that interface must be defined. The ODCIIndexGetMetadata(...) routine is one such method in the ODCIIndex Interface. When the ODCIIndex Interface is implemented for a new indextype, the ODCIIndexGetMetadata(...)routine is used to specify how metadata for that indextype should be handled.

Oracle DBMS_EXPORT_EXTENSION

DBMS_EXPORT_EXTENSION is a built-in Oracle package used to import and export information in an Oracle Database. The DBMS_EXPORT_EXTENSION package implements the ODCIIndex Interface ODCIIndexGetMetadata(...) routine. Note that this package is owned by SYSDBA, but is accessible to the PUBLIC by default.

The Problem

The DBMS_EXPORT_EXTENSION package fails to properly sanitize user-controlled input. Specifically, if the GET_DOMAIN_INDEX_METADATA(...)routine is executed with the ODCIIndexGetMetadata(...)routine and attacker-supplied SQL commands, the SQL commands will be executed with SYSDBA privileges.

Based on research into public information, we believe that this issue is Oracle vuln# DB06 in the Oracle Critical Patch Update for July 2006.

Note that exploit code for this issue is publicly available.

II. Impact

A remote attacker with some authentication credentials may be able to execute arbitrary SQL statements with elevated privileges. This may allow the attacker to access and modify sensitive information within an Oracle database.

III. Solution

Apply Oracle CPU

Oracle has released the Oracle Critical Patch Update (CPU) for July 2006. It is unclear from the Oracle documentation whether this issue is addressed by this CPU. Public reports indicate that this issue has been addressed by this CPU, but this has not been confirmed.
Until a patch for this issue can be applied, the following actions may reduce the chances of exploitation:

Restrict access to Oracle

Only known and trusted users should be allowed access to Oracle. Additionally, user accounts should only be granted the fewest privileges needed to perform necessary tasks.

Change login credentials for default Oracle accounts

Oracle creates numerous default accounts when it is installed. Upon installation, accounts that are not needed should be disabled and the login credentials for needed accounts should be changed.

Systems Affected

VendorStatusDate Updated
Oracle CorporationVulnerable19-Jul-2006

References


http://www.juniper.net/security/auto/vulnerabilities/vuln3319.html
http://secunia.com/advisories/19860
http://www.securityfocus.com/bid/17699
http://www.red-database-security.com/exploits/oracle-sql-injection-oracle-dbms_export_extension.html
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2006.html
http://www.red-database-security.com/advisory/oracle_cpu_jul_2006.html

Credit

This vulnerability was reported by David Litchfield of NGS Software.

This document was written by Jeff Gennari and Stephen Rhoton.

Other Information

Date Public04/26/2006
Date First Published05/03/2006 12:11:14 PM
Date Last Updated07/25/2006
CERT Advisory 
CVE NameCVE-2006-3702
US-CERT Technical Alerts 
Metric18.56
Document Revision99

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader