http://www.eweek.com/article/0,3658,s=712&a=28027,00.asp By Dennis Fisher June 12, 2002 Security researchers have found two serious buffer overruns in Oracle Corp. products, both of which give an attacker complete control of a vulnerable machine. One flaw affects Windows machines running any version of Oracle9i, while the other affects any machine running the 9i Application Server, according to a bulletin released by Next Generation Security Software Ltd. The Oracle Net Listener process in 9i contains a remotely exploitable buffer overrun flaw that when successfully exploited gives an attacker the ability to run whatever code he chooses. The Listener monitors TCP port 1521 for client requests to use the 9i database. When a request comes in, the process passes it to the database. Such requests are passed in Transparent Network Substrate packets, which include a "service_name" parameter. If an attacker supplies an overly long value for this parameter when forming an error message to be written in the log file, the value overwrites a return address on the stack. Any code that the attacker runs on the exploited machine will run in the local system context by default on Windows machines, the NGSS alert says. And because the overrun happens before the error message is written to the log file, it may be difficult to detect a successful attack. The second flaw is a buffer overrun vulnerability in the Report Server component of the 9i Application Server. If an attacker sent an overly long database name parameter to the rwcgi60 program using the "setauth" method, he could overrun the buffer and gain control of the process's execution. On Windows machines, the attacker's code would run in the local system context by default, the bulletin says. Oracle, of Redwood Shores, Calif., has released patches for the flaws, which are available through its Metalink service. - ISN is currently hosted by Attrition.org To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY of the mail.
This archive was generated by hypermail 2b30 : Thu Jun 13 2002 - 03:38:18 PDT