Oracle Database Server Authentication Bypass Vulnerability

Bugtraq ID:	98758
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 24 2017 12:00AM
Updated:	Apr 24 2017 12:00AM
Credit:	Unknown
Vulnerable:	Oracle Database 11g Release 2 11.2 4.5 Oracle Database 11g Release 2 11.2 1.0 Oracle Database 11g Release 2 11.2.0.4 Oracle Database 11g Release 2 11.2.0.3 Oracle Database 11g Release 2 11.2.0.2 Oracle Database 11g Release 2 0 Oracle Database 10g Release 2 10.2 5 Oracle Database 10g Release 2 10.2 2 Oracle Database 10g Release 2 10.2 1 Oracle Database 10g Release 2 10.2.0.4 Oracle Database 10g Release 2 10.2.0.3 Oracle Database 7.2
Not Vulnerable:

Oracle Database Server Authentication Bypass Vulnerability

Oracle Database Server is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks.

Oracle Database Server Authentication Bypass Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Oracle Database Server Authentication Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oracle Database Server Authentication Bypass Vulnerability

References:

• misterch0c/shadowbroker (shadowbroker)
  
• Oracle Homepage (Oracle)
  
• PassFreely Attack Bypasses Oracle Database Authentication (databreachtoday.com)
  
• Advisory - Data leakage of multiple 0-days and tools (mnemonic.no)