Oracle Database 9i SQL Command Buffer Overflow Vulnerability
BID:11120
Info
Oracle Database 9i SQL Command Buffer Overflow Vulnerability
| Bugtraq ID: | 11120 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 07 2004 12:00AM |
| Updated: | Sep 07 2004 12:00AM |
| Credit: | Discovery of this issue is credited to Alexander Kornbrust. |
| Vulnerable: |
Oracle Oracle9i Standard Edition 9.2 .3 Oracle Oracle9i Standard Edition 9.2 .0.5 Oracle Oracle9i Standard Edition 9.2 .0.3 Oracle Oracle9i Standard Edition 9.2 .0.2 Oracle Oracle9i Standard Edition 9.2 .0.1 Oracle Oracle9i Standard Edition 9.2 Oracle Oracle9i Standard Edition 9.0.2 Oracle Oracle9i Standard Edition 9.0.1 .5 Oracle Oracle9i Standard Edition 9.0.1 .4 Oracle Oracle9i Standard Edition 9.0.1 .3 Oracle Oracle9i Standard Edition 9.0.1 .2 Oracle Oracle9i Standard Edition 9.0.1 Oracle Oracle9i Standard Edition 9.0 .2.4 Oracle Oracle9i Standard Edition 9.0 Oracle Oracle9i Personal Edition 9.2 .0.5 Oracle Oracle9i Personal Edition 9.2 .0.3 Oracle Oracle9i Personal Edition 9.2 .0.2 Oracle Oracle9i Personal Edition 9.2 .0.1 Oracle Oracle9i Personal Edition 9.2 Oracle Oracle9i Personal Edition 9.0.1 .5 Oracle Oracle9i Personal Edition 9.0.1 .4 Oracle Oracle9i Personal Edition 9.0.1 Oracle Oracle9i Personal Edition 9.0 .2.4 Oracle Oracle9i Lite 5.0 .2.9.0 Oracle Oracle9i Lite 5.0 .2.0.0 Oracle Oracle9i Lite 5.0 .1.0.0 Oracle Oracle9i Lite 5.0 .0.0.0 Oracle Oracle9i Enterprise Edition 9.2 .2 Oracle Oracle9i Enterprise Edition 9.2 .0.5 Oracle Oracle9i Enterprise Edition 9.2 .0.3 Oracle Oracle9i Enterprise Edition 9.2 .0.1 Oracle Oracle9i Enterprise Edition 9.2 .0 Oracle Oracle9i Enterprise Edition 9.0.1 .5 Oracle Oracle9i Enterprise Edition 9.0.1 .4 Oracle Oracle9i Enterprise Edition 9.0.1 Oracle Oracle9i Enterprise Edition 9.0 .2.4 Oracle Oracle9i Developer Suite (DS) 2000 Oracle Oracle9i Developer Suite (DS) 2000 Oracle Oracle9i Client Edition 9.2 .0.2 Oracle Oracle9i Client Edition 9.2 .0.1 Oracle Oracle9i Application Server Web Cache 9.0.3 .1 Oracle Oracle9i Application Server Web Cache 9.0.2 .3 Oracle Oracle9i Application Server Web Cache 9.0.2 .2 Oracle Oracle9i Application Server Reports 9.0.2 .1 Oracle Oracle9i Application Server Reports 9.0.2 Oracle Oracle9i Application Server Portal 9.0.2 .3B Oracle Oracle9i Application Server Portal 9.0.2 .3A Oracle Oracle9i Application Server Portal 9.0.2 .3 Oracle Oracle9i Application Server 9.0.3 .1 Oracle Oracle9i Application Server 9.0.3 Oracle Oracle9i Application Server 9.0.2 .3 Oracle Oracle9i Application Server 9.0.2 .2 Oracle Oracle9i Application Server 9.0.2 .1 Oracle Oracle9i Application Server 9.0.2 .0.1 Oracle Oracle9i Application Server 9.0.2 .0.0 Oracle Oracle9i Application Server 9.0.2 |
| Not Vulnerable: | |
Discussion
Oracle Database 9i SQL Command Buffer Overflow Vulnerability
This issue corresponds to one of the unspecified vulnerabilities mentioned in BID 10871 (Oracle Multiple Unspecified Vulnerabilities) and addressed by Oracle Alert #68. The issue is being assigned its own BID due to the release of specific technical information.
Reportedly Oracle Database 9i is affected by an SQL command buffer overflow vulnerability. This issue is due to a failure of the application to properly verify user-supplied string lengths prior to copying them into finite process buffers.
Successful exploitation of this issue would allow a malicious user to manipulate the memory of the affected database process. This issue will ultimately facilitate arbitrary code execution with the privileges of the affected process.
This issue corresponds to one of the unspecified vulnerabilities mentioned in BID 10871 (Oracle Multiple Unspecified Vulnerabilities) and addressed by Oracle Alert #68. The issue is being assigned its own BID due to the release of specific technical information.
Reportedly Oracle Database 9i is affected by an SQL command buffer overflow vulnerability. This issue is due to a failure of the application to properly verify user-supplied string lengths prior to copying them into finite process buffers.
Successful exploitation of this issue would allow a malicious user to manipulate the memory of the affected database process. This issue will ultimately facilitate arbitrary code execution with the privileges of the affected process.
Exploit / POC
Oracle Database 9i SQL Command Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Oracle Database 9i SQL Command Buffer Overflow Vulnerability
Solution:
Oracle has released an alert (#68) and a patch to address these issues. Information regarding obtaining and applying an appropriate patch can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=281189.1
It should be noted that a valid subscription to the metalink service is required in order to view this document.
It is reported that software conflicts may arise when these patches are installed against binaries that have already had patches installed. Additionally, although Oracle 9i 9.2.x.x database server is supported, it is reported that customers may be required to update to versions 9.2.0.4/9.2.0.5 prior to applying these patches. This action might also be required for other releases and products. Customers are advised to contact the vendor for further information and support in regards to the installation of appropriate updates.
Update - Nov 12, 2004: Oracle has released an update for the patch for Database Server 9.2.0.5 running on HPUX 64-bit platform. It is reported that original patch did not include 32-bit library files. Oracle recommends uninstalling the original patch and replacing it with the patch dated 19-OCT-2004. The problem exists in patch versions dated before 19-OCT-2004. The updated patch is available from the Oracle Metalink site.
A message from "David Litchfield" <[email protected]> is available that states that some of the vulnerabilities in alert #68 may not have been successfully fixed by Oracle. Users of affected packages should refer to the referenced message, and contact their vendor for further information on the status of fixes.
Solution:
Oracle has released an alert (#68) and a patch to address these issues. Information regarding obtaining and applying an appropriate patch can be found at the following location:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=281189.1
It should be noted that a valid subscription to the metalink service is required in order to view this document.
It is reported that software conflicts may arise when these patches are installed against binaries that have already had patches installed. Additionally, although Oracle 9i 9.2.x.x database server is supported, it is reported that customers may be required to update to versions 9.2.0.4/9.2.0.5 prior to applying these patches. This action might also be required for other releases and products. Customers are advised to contact the vendor for further information and support in regards to the installation of appropriate updates.
Update - Nov 12, 2004: Oracle has released an update for the patch for Database Server 9.2.0.5 running on HPUX 64-bit platform. It is reported that original patch did not include 32-bit library files. Oracle recommends uninstalling the original patch and replacing it with the patch dated 19-OCT-2004. The problem exists in patch versions dated before 19-OCT-2004. The updated patch is available from the Oracle Metalink site.
A message from "David Litchfield" <[email protected]> is available that states that some of the vulnerabilities in alert #68 may not have been successfully fixed by Oracle. Users of affected packages should refer to the referenced message, and contact their vendor for further information on the status of fixes.
References
Oracle Database 9i SQL Command Buffer Overflow Vulnerability
References:
References:
- Alert #68: Oracle Security Update (Oracle)
- Technical Cyber Security Alert TA04-245A (CERT/CC)
- Opinion: Complete failure of Oracle security response and utter neglect of their ("David Litchfield"