Oracle 10g Database DBMS_SCHEDULER Remote Command Execution Vulnerability
BID:11091
Info
Oracle 10g Database DBMS_SCHEDULER Remote Command Execution Vulnerability
| Bugtraq ID: | 11091 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 01 2004 12:00AM |
| Updated: | Sep 01 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to Pete Finnigan in conjunction with Jonathan Gennick and Alexander Kornbrust. |
| Vulnerable: |
Oracle Oracle10g Standard Edition 10.1 .0.2 Oracle Oracle10g Standard Edition 9.0.4 .0 Oracle Oracle10g Personal Edition 10.1 .0.2 Oracle Oracle10g Personal Edition 9.0.4 .0 Oracle Oracle10g Enterprise Edition 10.1 .0.2 Oracle Oracle10g Enterprise Edition 9.0.4 .0 Oracle Oracle10g Application Server 10.1 .0.2 Oracle Oracle10g Application Server 9.0.4 .0 Oracle Application Server 10g 9.0.4 |
| Not Vulnerable: | |
Discussion
Oracle 10g Database DBMS_SCHEDULER Remote Command Execution Vulnerability
Oracle 10g Database is reported prone to a remote command execution vulnerability. It is reported that the vulnerability exists in the scheduler functionality that was added to Oracle 10g R1.
A remote authenticated attacker may exploit this vulnerability to execute arbitrary commands in the context of the vulnerable software.
This issue was originally announced as an undisclosed issue in BID 10871.
Oracle 10g Database is reported prone to a remote command execution vulnerability. It is reported that the vulnerability exists in the scheduler functionality that was added to Oracle 10g R1.
A remote authenticated attacker may exploit this vulnerability to execute arbitrary commands in the context of the vulnerable software.
This issue was originally announced as an undisclosed issue in BID 10871.
Exploit / POC
Oracle 10g Database DBMS_SCHEDULER Remote Command Execution Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Oracle 10g Database DBMS_SCHEDULER Remote Command Execution Vulnerability
Solution:
Oracle has released an alert (#68) and a patch to address this and other issues. Information regarding obtaining and applying an appropriate patch can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=281189.1
It should be noted that a valid subscription to the metalink service is required in order to view this document.
It is reported that software conflicts may arise when these patches are installed against binaries that have already had patches installed. Additionally, although Oracle 9i 9.2.x.x database server is supported, it is reported that customers may be required to update to versions 9.2.0.4/9.2.0.5 prior to applying these patches. This action might also be required for other releases and products. Customers are advised to contact the vendor for further information and support in regards to the installation of appropriate updates.
A message from "David Litchfield" <[email protected]> is available that states that some of the vulnerabilities in alert #68 may not have been successfully fixed by Oracle. Users of affected packages should refer to the referenced message, and contact their vendor for further information on the status of fixes.
Solution:
Oracle has released an alert (#68) and a patch to address this and other issues. Information regarding obtaining and applying an appropriate patch can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=281189.1
It should be noted that a valid subscription to the metalink service is required in order to view this document.
It is reported that software conflicts may arise when these patches are installed against binaries that have already had patches installed. Additionally, although Oracle 9i 9.2.x.x database server is supported, it is reported that customers may be required to update to versions 9.2.0.4/9.2.0.5 prior to applying these patches. This action might also be required for other releases and products. Customers are advised to contact the vendor for further information and support in regards to the installation of appropriate updates.
A message from "David Litchfield" <[email protected]> is available that states that some of the vulnerabilities in alert #68 may not have been successfully fixed by Oracle. Users of affected packages should refer to the referenced message, and contact their vendor for further information on the status of fixes.
References
Oracle 10g Database DBMS_SCHEDULER Remote Command Execution Vulnerability
References:
References:
- Alert #68: Oracle Security Update (Oracle)
- PeteFinnigan.com Security Advisory - DBMS_SCHEDULER (PeteFinnigan.com )
- Technical Cyber Security Alert TA04-245A (CERT/CC)
- Opinion: Complete failure of Oracle security response and utter neglect of their ("David Litchfield"