search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Oracle9i Application Server allows unauthenticated access to PL/SQL applications via alternate Database Access Descriptor

Vulnerability Note VU#193523

Original Release Date: 2002-03-01 | Last Revised: 2002-03-15


A vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS). By specifying the Database Access Descriptor (DAD) used to access a PL/SQL application, an attacker could gain unauthorized access to the application.


NGSSoftware has released a paper titled Hackproofing Oracle Application Server that describes a number of security issues in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses the DAD substitution problem, where an attacker could bypass authentication by specifying which DAD to use to access a PL/SQL application.

Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. A DAD defines how a PL/SQL request connects to an application and is identified in the URL. For example:


A DAD can specify the credentials used to access an application, which may effectively grant anonymous (PUBLIC) access. If a DAD does not specify credentials, Apache will prompt the user and pass the credentials to the application using the PL/SQL module. Since the DAD is specified in the URL, an attacker can choose which DAD is used to access a particular application. By choosing a DAD that contains valid credentials, an attacker may be able to gain access to an application without being properly authenticated. In the case where one DAD provides PUBLIC access to one application and another DAD requires authentication for another application in the same database schema, an attacker can specify the PUBLIC DAD and gain unauthenticated access to the protected application.

The vulnerable PL/SQL module may also be used by Oracle9i Database and Oracle8i Database.


An unauthenticated remote attacker could gain access to an Oracle PL/SQL application. Depending on the capabilities of the application, the attacker could read, modify, or delete data.


Block or Restrict Access
Unauthenticated PUBLIC access to PL/SQL applications and procedures can be restricted using the exclusion_list parameter in the PL/SQL gateway configuration file, /Apache/modplsql/cfg/ This solution is described in Oracle Security Alert #28. For more information, read the section titled Protecting the PL/SQL Procedures Granted to PUBLIC in the Oracle iAS documentation under Using the PL/SQL Gateway.

Disable Vulnerable Service

Disable the PL/SQL service (modplsql or mod_plsql in Apache).

Vendor Information


Oracle Affected

Notified:  March 03, 2002 Updated: March 05, 2002



Vendor Statement

Oracle has released Oracle Security Alert #28.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.

This document was written by Art Manion.

Other Information

CVE IDs: None
Severity Metric: 5.94
Date Public: 2002-01-10
Date First Published: 2002-03-01
Date Last Updated: 2002-03-15 20:20 UTC
Document Revision: 41

Sponsored by CISA.