Vulnerability Note VU#750299
Oracle9i Application Server Apache PL/SQL module vulnerable to buffer overflow via HTTP request
A buffer overflow vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS). A maliciously crafted HTTP request made to the PL/SQL module could cause a denial of service or execute arbitrary code with the privileges of the Apache service.
NGSSoftware has released Insight Security Research Advisory #NISR06022002B, which describes a number of vulnerabilities in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses a buffer overflow vulnerability caused by a crafted HTTP request made to the PL/SQL module.
Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. A crafted HTTP request made to the PL/SQL module could trigger a buffer overflow, executing arbitrary code with the privileges of the Apache service.
The vulnerable PL/SQL module may also be used by Oracle9i Database and Oracle8i Database.
An unauthenticated, remote attacker could cause a denial of service or execute arbitrary code on the system with the privileges of the Apache process. Since the Apache service typically runs with SYSTEM privileges on Windows NT and Windows 2000, an attacker may be able to gain complete control of the system.
Block or Restrict Access
Monitor and/or restrict access to the Apache service (typically 80/tcp). It may be possible to use TCP Wrapper or similar technology to provide improved access control and logging. Additionally, an application-level firewall and Intrusion Detection System (IDS) may be able to filter requests made to the Apache service. Note that these workarounds are designed to limit access and detect exploit attempts. These workarounds do not prevent exploitation of this vulnerability.
Disable Vulnerable Service
Disable the vulnerable service (modplsql or mod_plsql in Apache).
If you are a vendor and your product is affected, let
|Vendor||Status||Date Notified||Date Updated|
|Oracle||Affected||02 Mar 2002||05 Mar 2002|
The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.
This document was written by Art Manion.
06 Feb 2002
Date First Published:
28 Feb 2002
Date Last Updated:
15 Mar 2002
If you have feedback, comments, or additional information about this vulnerability, please send us email.