Two Oracle Flaws Put Machines at Risk

[InfoSec News <isn () c4i org>]

http://www.eweek.com/article/0,3658,s=712&a=28027,00.asp

By Dennis Fisher 
June 12, 2002 

Security researchers have found two serious buffer overruns in Oracle
Corp. products, both of which give an attacker complete control of a
vulnerable machine.

One flaw affects Windows machines running any version of Oracle9i,
while the other affects any machine running the 9i Application Server,
according to a bulletin released by Next Generation Security Software
Ltd.

The Oracle Net Listener process in 9i contains a remotely exploitable
buffer overrun flaw that when successfully exploited gives an attacker
the ability to run whatever code he chooses. The Listener monitors TCP
port 1521 for client requests to use the 9i database. When a request
comes in, the process passes it to the database.

Such requests are passed in Transparent Network Substrate packets,
which include a "service_name" parameter. If an attacker supplies an
overly long value for this parameter when forming an error message to
be written in the log file, the value overwrites a return address on
the stack.

Any code that the attacker runs on the exploited machine will run in
the local system context by default on Windows machines, the NGSS
alert says. And because the overrun happens before the error message
is written to the log file, it may be difficult to detect a successful
attack.

The second flaw is a buffer overrun vulnerability in the Report Server
component of the 9i Application Server. If an attacker sent an overly
long database name parameter to the rwcgi60 program using the
"setauth" method, he could overrun the buffer and gain control of the
process's execution.

On Windows machines, the attacker's code would run in the local system
context by default, the bulletin says.

Oracle, of Redwood Shores, Calif., has released patches for the flaws,
which are available through its Metalink service.

 


-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.