Oracle 11gR2 Multiple Remote Privilege Escalation Vulnerabilities

Bugtraq ID:	38115
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 05 2010 12:00AM
Updated:	Mar 15 2010 05:42PM
Credit:	David Litchfield
Vulnerable:	Oracle Oracle11g Standard Edition 11.1 6 Oracle Oracle11g Standard Edition 11.1 6 Oracle Oracle11g Standard Edition 11.1 .7 Oracle Oracle11g Standard Edition 11.2.0.1.0 Oracle Oracle11g Enterprise Edition 11.1 6 Oracle Oracle11g Enterprise Edition 11.2.0.1.0 Oracle Oracle11g Enterprise Edition 11.1.0.7 Oracle Oracle10g Standard Edition 10.3 .1 Oracle Oracle10g Standard Edition 10.2 .5 Oracle Oracle10g Standard Edition 10.2 .3 Oracle Oracle10g Standard Edition 10.2 .2 Oracle Oracle10g Standard Edition 10.2 .1 Oracle Oracle10g Standard Edition 10.1 .5 Oracle Oracle10g Standard Edition 10.1 .4.2 Oracle Oracle10g Standard Edition 10.1 .4 Oracle Oracle10g Standard Edition 10.1 .0.5 Oracle Oracle10g Standard Edition 10.1 .0.4 Oracle Oracle10g Standard Edition 10.1 .0.3.1 Oracle Oracle10g Standard Edition 10.1 .0.3 Oracle Oracle10g Standard Edition 10.1 .0.2 Oracle Oracle10g Standard Edition 10.2.0.4 Oracle Oracle10g Standard Edition 10.2 Oracle Oracle10g Personal Edition 10.3 .1 Oracle Oracle10g Personal Edition 10.2 .5 Oracle Oracle10g Personal Edition 10.2 .3 Oracle Oracle10g Personal Edition 10.2 .2 Oracle Oracle10g Personal Edition 10.2 .1 Oracle Oracle10g Personal Edition 10.1 .5 Oracle Oracle10g Personal Edition 10.1 .4 Oracle Oracle10g Personal Edition 10.1 .0.4 Oracle Oracle10g Personal Edition 10.1 .0.3.1 Oracle Oracle10g Personal Edition 10.1 .0.3 Oracle Oracle10g Personal Edition 10.1 .0.2 Oracle Oracle10g Personal Edition 9.0.4 .0 Oracle Oracle10g Personal Edition 10.2.0.4 Oracle Oracle10g Personal Edition 10.2 Oracle Oracle10g Enterprise Edition 10.3 .1 Oracle Oracle10g Enterprise Edition 10.2 .5 Oracle Oracle10g Enterprise Edition 10.2 .3 Oracle Oracle10g Enterprise Edition 10.2 .2 Oracle Oracle10g Enterprise Edition 10.2 .1 Oracle Oracle10g Enterprise Edition 10.1 .5 Oracle Oracle10g Enterprise Edition 10.1 .5 Oracle Oracle10g Enterprise Edition 10.1 .4.2 Oracle Oracle10g Enterprise Edition 10.1 .4 Oracle Oracle10g Enterprise Edition 10.1 .0.4 Oracle Oracle10g Enterprise Edition 10.1 .0.3.1 Oracle Oracle10g Enterprise Edition 10.1 .0.3 Oracle Oracle10g Enterprise Edition 10.1 .0.2 Oracle Oracle10g Enterprise Edition 9.0.4 .0 Oracle Oracle10g Enterprise Edition 10.2.0.4 Oracle Oracle10g Enterprise Edition 10.2.0.2 64 bit Oracle Oracle10g Enterprise Edition 10.2
Not Vulnerable:

Oracle 11gR2 Multiple Remote Privilege Escalation Vulnerabilities

Oracle Database is prone to multiple remote privilege-escalation issues because it fails to properly restrict access to certain packages.

The attacker can exploit these issues to escalate their privileges to DBA or execute arbitrary operating system commands with SYSTEM privileges, leading to a complete compromise of an affected computer.

These vulnerabilities affect Oracle Database 11gR2. One of the issues also affects Oracle Database 10gR2.

Oracle 11gR2 Multiple Remote Privilege Escalation Vulnerabilities

Attackers can use standard tools and commands to exploit these issues.

NOTE: The researcher who discovered these issues released detailed instructions, including the required queries, to exploit these vulnerabilities. Please see the references for more information.

The following exploits are available:

• /data/vulnerabilities/exploits/38115-jvm_os_code_11g.rb
• /data/vulnerabilities/exploits/38115-jvm_os_code_10g.rb

Oracle 11gR2 Multiple Remote Privilege Escalation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle 11gR2 Multiple Remote Privilege Escalation Vulnerabilities

References:

• Hacking Aurora in Oracle 11g (David Litchfield)
  
• Metasploit Oracle Windows (sid)
  
• Oracle Homepage (Oracle)
  
• Vulnerability in Oracle 11gR2 allows system privileges for all (The H)