Oracle 9i/10g Database Fine Grained Audit Logging Failure Vulnerability

Bugtraq ID:	13510
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	May 05 2005 12:00AM
Updated:	May 05 2005 12:00AM
Credit:	Discovery of this issue is credited to Alexander Kornbrust.
Vulnerable:	Oracle Oracle9i Standard Edition 9.2 .6 Oracle Oracle9i Standard Edition 9.2 .3 Oracle Oracle9i Standard Edition 9.2 .0.5 Oracle Oracle9i Standard Edition 9.2 .0.3 Oracle Oracle9i Standard Edition 9.2 .0.2 Oracle Oracle9i Standard Edition 9.2 .0.1 Oracle Oracle9i Standard Edition 9.2 Oracle Oracle9i Standard Edition 9.0.4 Oracle Oracle9i Standard Edition 9.0.2 Oracle Oracle9i Standard Edition 9.0.1 .5 Oracle Oracle9i Standard Edition 9.0.1 .4 Oracle Oracle9i Standard Edition 9.0.1 .3 Oracle Oracle9i Standard Edition 9.0.1 .2 Oracle Oracle9i Standard Edition 9.0.1 Oracle Oracle9i Standard Edition 9.0 .2.4 Oracle Oracle9i Standard Edition 9.0 Oracle Oracle9i Standard Edition 8.1.7 Oracle Oracle9i Personal Edition 9.2 .6 Oracle Oracle9i Personal Edition 9.2 .0.5 Oracle Oracle9i Personal Edition 9.2 .0.3 Oracle Oracle9i Personal Edition 9.2 .0.2 Oracle Oracle9i Personal Edition 9.2 .0.1 Oracle Oracle9i Personal Edition 9.2 Oracle Oracle9i Personal Edition 9.0.4 Oracle Oracle9i Personal Edition 9.0.1 .5 Oracle Oracle9i Personal Edition 9.0.1 .4 Oracle Oracle9i Personal Edition 9.0.1 Oracle Oracle9i Personal Edition 9.0 .2.4 Oracle Oracle9i Personal Edition 8.1.7 Oracle Oracle9i Lite 5.0 .2.9.0 Oracle Oracle9i Lite 5.0 .2.0.0 Oracle Oracle9i Lite 5.0 .1.0.0 Oracle Oracle9i Lite 5.0 .0.0.0 Oracle Oracle9i Enterprise Edition 9.2 .6.0 Oracle Oracle9i Enterprise Edition 9.2 .2 Oracle Oracle9i Enterprise Edition 9.2 .0.5 Oracle Oracle9i Enterprise Edition 9.2 .0.3 Oracle Oracle9i Enterprise Edition 9.2 .0.1 Oracle Oracle9i Enterprise Edition 9.2 .0 Oracle Oracle9i Enterprise Edition 9.0.4 Oracle Oracle9i Enterprise Edition 9.0.1 .5 Oracle Oracle9i Enterprise Edition 9.0.1 .4 Oracle Oracle9i Enterprise Edition 9.0.1 Oracle Oracle9i Enterprise Edition 9.0 .2.4 Oracle Oracle9i Enterprise Edition 8.1.7 Oracle Oracle9i Developer Edition 9.0.4 Oracle Oracle10g Standard Edition 10.1 .0.4 Oracle Oracle10g Standard Edition 10.1 .0.3.1 Oracle Oracle10g Standard Edition 10.1 .0.3 Oracle Oracle10g Standard Edition 10.1 .0.2 Oracle Oracle10g Standard Edition 9.0.4 .0 Oracle Oracle10g Personal Edition 10.1 .0.4 Oracle Oracle10g Personal Edition 10.1 .0.3.1 Oracle Oracle10g Personal Edition 10.1 .0.3 Oracle Oracle10g Personal Edition 10.1 .0.2 Oracle Oracle10g Personal Edition 9.0.4 .0 Oracle Oracle10g Enterprise Edition 10.1 .0.4 Oracle Oracle10g Enterprise Edition 10.1 .0.3.1 Oracle Oracle10g Enterprise Edition 10.1 .0.3 Oracle Oracle10g Enterprise Edition 10.1 .0.2 Oracle Oracle10g Enterprise Edition 9.0.4 .0
Not Vulnerable:

Oracle 9i/10g Database Fine Grained Audit Logging Failure Vulnerability

Oracle 9i/10g Database is prone to a logging failure vulnerability that exists in Fine Grained Audit (FGA) functionality.

Reports indicate that FGA may be disabled inadvertently, without notifying the database administrator. This results in FGA failing to log queries subsequent to the logging failure, this occurs for all database users and may result in a false sense of security.

Oracle 9i/10g Database Fine Grained Audit Logging Failure Vulnerability

No exploit is required.

The following steps to reproduce are available:

1. Create user and objects and add policy.
connect /as sysdba
grant dba to fga identified by fga;
conn fga/fga
create table emp as select * from scott.emp;
execute dbms_fga.add_policy(object_schema=>'FGA',
object_name=>'EMP',policy_name=>'FGA_POLICY');

2. Run SQL from fga user
conn fga/fga
select count(*) from fga.emp;
select sql_text,to_char(timestamp,'HH24:MI:SS') time
from sys.dba_fga_audit_trail;

--> It will return 1 row.

3. Run SQL from SYS user
conn /as sysdba
select count(*) from fga.emp;
select sql_text,to_char(timestamp,'HH24:MI:SS') time
from sys.dba_fga_audit_trail;

--> It will return 1 row which was obtained by step 2.

A new row was not inserted.

4. Run SQL from fga user again

conn fga/fga
select count(*) from fga.emp;
select sql_text,to_char(timestamp,'HH24:MI:SS') time
from sys.dba_fga_audit_trail;

--> It will return 1 row which was obtained by step 2.

A new row was not inserted again.

Oracle 9i/10g Database Fine Grained Audit Logging Failure Vulnerability

Solution:
It is reported that this issue is addressed for Oracle Database 10g, by patch set 10.1.0.4. This is not confirmed. Customers are advised to contact the vendor for further information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Oracle 9i/10g Database Fine Grained Audit Logging Failure Vulnerability

References:

• Oracle Fine Grained Auditing Issue in Oracle 9i / 10g (Red Database Security)