Vulnerability Note VU#932124

Oracle DBMS_EXPORT_EXTENSION package vulnerable to SQL injection

Original Release date: 03 May 2006 | Last revised: 25 Jul 2006

Overview

A vulnerability in Oracle PL/SQL Export Extensions may allow an attacker to modify privileged database information.

Description

Oracle Extensions, ODCIIndex Interface, and ODCIIndexGetMetadata

Oracle extensions are used to create customized Oracle database constructs. An indextype is an Oracle extension that allows users to create specialized indexes on an Oracle database. To create a new indextype, the ODCIIndex Interface must be implemented, meaning that certain methods specified in that interface must be defined. The ODCIIndexGetMetadata(...) routine is one such method in the ODCIIndex Interface. When the ODCIIndex Interface is implemented for a new indextype, the ODCIIndexGetMetadata(...)routine is used to specify how metadata for that indextype should be handled.

Oracle DBMS_EXPORT_EXTENSION

DBMS_EXPORT_EXTENSION is a built-in Oracle package used to import and export information in an Oracle Database. The DBMS_EXPORT_EXTENSION package implements the ODCIIndex Interface ODCIIndexGetMetadata(...) routine. Note that this package is owned by SYSDBA, but is accessible to the PUBLIC by default.

The Problem

The DBMS_EXPORT_EXTENSION package fails to properly sanitize user-controlled input. Specifically, if the GET_DOMAIN_INDEX_METADATA(...)routine is executed with the ODCIIndexGetMetadata(...)routine and attacker-supplied SQL commands, the SQL commands will be executed with SYSDBA privileges.

Based on research into public information, we believe that this issue is Oracle vuln# DB06 in the Oracle Critical Patch Update for July 2006.

Note that exploit code for this issue is publicly available.

Impact

A remote attacker with some authentication credentials may be able to execute arbitrary SQL statements with elevated privileges. This may allow the attacker to access and modify sensitive information within an Oracle database.

Solution

Apply Oracle CPU

Oracle has released the Oracle Critical Patch Update (CPU) for July 2006. It is unclear from the Oracle documentation whether this issue is addressed by this CPU. Public reports indicate that this issue has been addressed by this CPU, but this has not been confirmed.

Until a patch for this issue can be applied, the following actions may reduce the chances of exploitation:

Restrict access to Oracle

Only known and trusted users should be allowed access to Oracle. Additionally, user accounts should only be granted the fewest privileges needed to perform necessary tasks.

Change login credentials for default Oracle accounts

Oracle creates numerous default accounts when it is installed. Upon installation, accounts that are not needed should be disabled and the login credentials for needed accounts should be changed.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Oracle CorporationAffected02 May 200619 Jul 2006
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This vulnerability was reported by David Litchfield of NGS Software.

This document was written by Jeff Gennari and Stephen Rhoton.

Other Information

  • CVE IDs: CVE-2006-3702
  • Date Public: 26 Apr 2006
  • Date First Published: 03 May 2006
  • Date Last Updated: 25 Jul 2006
  • Severity Metric: 18.56
  • Document Revision: 99

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.