Vulnerability Note VU#997403

Oracle Reports Server Reports Web Cartridge (RWCGI60) vulnerable to buffer overflow via database name parameter

Original Release date: 04 Jun 2002 | Last revised: 15 Nov 2002

Overview

A buffer overflow vulnerability in Oracle Reports Server 6i could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Reports Server process.

Description

Oracle Reports Server is a component of Oracle Application Server that handles client requests for reports from multiple data sources. Oracle Reports Server is capable of accepting requests and delivering reports over the web using a Reports Web Cartridge (RWCGI60). RWCGI60 is a CGI program that translates and delivers information between the Oracle HTTP Server and the Oracle Reports Server. According to a report by NGSSoftware, RWCGI60 is vulnerable to a buffer overflow via an HTTP request containing a specially crafted database name parameter.

According to Oracle Security Alert #35, Oracle Reports Server 6.0.8.18.0 and earlier are vulnerable, and Oracle9i Application Server 1.0.x includes a vulnerable version of Oracle Reports Server.

Impact

An unauthenticated, remote attacker could execute arbitrary code or cause a denial of service on a vulnerable system. By default, the Oracle Reports stand-alone server runs as SYSTEM on Windows NT and Windows 2000 systems.

Solution


Apply a Patch

Oracle Security Alert #35 provides information on patches that address this vulnerability.


Restrict Access

Where possible, limit access to trusted users, hosts, and networks.

Disable Oracle Reports Services

If your site does not use the Oracle Reports Services, disable it.

Disable RWCGI60

If you are able to use other components of Oracle Reports Services to process reports via HTTP, do not use RWCGI60.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
OracleAffected31 May 200206 Jun 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT/CC thanks David Litchfield of NGSSoftware for information used in this document.

This document was written by Art Manion.

Other Information

  • CVE IDs: CAN-2002-0947
  • Date Public: 27 May 2002
  • Date First Published: 04 Jun 2002
  • Date Last Updated: 15 Nov 2002
  • Severity Metric: 11.66
  • Document Revision: 47

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.