Oracle 10g Alter Session Integer Overflow Vulnerability

Bugtraq ID:	19201
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 27 2006 12:00AM
Updated:	Jul 31 2006 11:31PM
Credit:	putosoft softputo is credited with the discovery of this vulnerability.
Vulnerable:	Oracle Oracle10g Standard Edition 10.2 .3 Oracle Oracle10g Standard Edition 10.2 .2 Oracle Oracle10g Standard Edition 10.2 .1 Oracle Oracle10g Enterprise Edition 10.2 .3 Oracle Oracle10g Enterprise Edition 10.2 .2 Oracle Oracle10g Enterprise Edition 10.2 .1
Not Vulnerable:

Oracle 10g Alter Session Integer Overflow Vulnerability

Oracle 10g is reportedly prone to a integer-overflow vulnerability because the application fails to allocate a large enough data type to accommodate user-supplied input before using it in a query. This issue has not been confirmed.

An attacker could exploit this vulnerability to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely cause denial-of-service conditions.

Reports indicate that Oracle 10g R2 is vulnerable; other versions may also be affected.

Oracle 10g Alter Session Integer Overflow Vulnerability

The following proof of concept was provided:

Connect with any user with only CREATE SESSION
SQL> alter session set events '10046 trace name context forever, level 16';

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

Oracle 10g Alter Session Integer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Oracle 10g Alter Session Integer Overflow Vulnerability

References:

• Oracle Homepage (Oracle)
  
• Oracle 10g R2 and, probably, all previous versions (putosoft softputo)