A buffer overflow vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS). This vulnerability could allow an unauthenticated remote attacker to cause a denial-of-service or execute arbitrary code on the system with the privileges of the Apache process.
NGSSoftware has released Insight Security Research Advisory #NISR06022002B that describes a number of vulnerabilities in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses a buffer overflow vulnerability caused by a crafted cache directory name entered in the PL/SQL gateway configuration page.
Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. The PL/SQL module supports caching of PL/SQL objects and provides a web-based administration interface to configure the cache and other settings. A malformed directory name specified in the cache configuration form could trigger a buffer overflow, executing arbitrary code with the privileges of the Apache service. In the default configuration, the administration pages are available to anyone who is able to access to the web server [VU#611776].
An unauthenticated remote attacker could cause a denial of service or execute arbitrary code on the system with the privileges of the Apache process. Since the Apache service typically runs with SYSTEM privileges on Windows NT and Windows 2000, an attacker may be able to gain complete control of the system.
The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.
This document was written by Art Manion.
|Date First Published:||2002-02-28|
|Date Last Updated:||2002-03-15 20:21 UTC|