Oracle Database Server InterMedia Denial of Service Vulnerability

Bugtraq ID:	13239
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 18 2005 12:00AM
Updated:	Apr 18 2005 12:00AM
Credit:	Esteban Martínez Fayó is credited with the discovery of this vulnerability.
Vulnerable:	Oracle Oracle9i Standard Edition 9.2 .0.5 Oracle Oracle9i Standard Edition 9.2 .0.3 Oracle Oracle9i Standard Edition 9.2 .0.2 Oracle Oracle9i Standard Edition 9.2 .0.1 Oracle Oracle9i Standard Edition 9.2 Oracle Oracle9i Standard Edition 9.0 .2.4 Oracle Oracle9i Personal Edition 9.2 .0.5 Oracle Oracle9i Personal Edition 9.2 .0.3 Oracle Oracle9i Personal Edition 9.2 .0.2 Oracle Oracle9i Personal Edition 9.2 .0.1 Oracle Oracle9i Personal Edition 9.2 Oracle Oracle9i Personal Edition 9.0 .2.4 Oracle Oracle9i Enterprise Edition 9.2 .2 Oracle Oracle9i Enterprise Edition 9.2 .0.3 Oracle Oracle9i Enterprise Edition 9.2 .0.1 Oracle Oracle9i Enterprise Edition 9.2 .0 Oracle Oracle9i Enterprise Edition 9.0 .2.4 Oracle Oracle10g Standard Edition 10.1 .0.2 Oracle Oracle10g Standard Edition 9.0.4 .0 Oracle Oracle10g Personal Edition 10.1 .0.2 Oracle Oracle10g Personal Edition 9.0.4 .0 Oracle Oracle10g Enterprise Edition 10.1 .0.2 Oracle Oracle10g Enterprise Edition 9.0.4 .0
Not Vulnerable:

Oracle Database Server InterMedia Denial of Service Vulnerability

There is a denial of service vulnerability in Oracle Database Server. This issue is a result of a failure in the application to properly sanitize user-supplied input.

This issue affects the Intermedia component and requires SQL (Oracle Net) access. A successful attack can compromise the availability of a vulnerable server.

Oracle has released a Critical Patch Update to address this issue.

It should be noted that this issue was previously reported in BID 13139 (Oracle Multiple Vulnerabilities); it has been assigned its own BID.

Oracle Database Server InterMedia Denial of Service Vulnerability

The following example SQL queries demonstrate how the vulnerability may be triggered:

http://www.argeniss.com/research/OraIntermediaExploit.txt

Oracle Database Server InterMedia Denial of Service Vulnerability

Solution:
Oracle has released a Critical Patch Update (Critical Patch Update - April 2005) to address these issues. Information regarding obtaining and applying an appropriate patch can be found in the Oracle Critical Patch Update in references.

Pre-Installation Notes for Oracle Database Server can be found at the following location:

http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=301045.1

Oracle Database Server InterMedia Denial of Service Vulnerability

References:

• Critical Patch Update - April 2005 (Oracle)
  
• Oracle Homepage (Oracle)
  
• OraIntermediaExploit.txt (Argeniss)
  
• OraIntermediaWorkaround.sql (Argeniss)