[ISN] Two Oracle Flaws Put Machines at Risk

From: InfoSec News (isnat_private)
Date: Thu Jun 13 2002 - 00:47:31 PDT

  • Next message: InfoSec News: "[ISN] Firms recast security as a money saver"

    By Dennis Fisher 
    June 12, 2002 
    Security researchers have found two serious buffer overruns in Oracle
    Corp. products, both of which give an attacker complete control of a
    vulnerable machine.
    One flaw affects Windows machines running any version of Oracle9i,
    while the other affects any machine running the 9i Application Server,
    according to a bulletin released by Next Generation Security Software
    The Oracle Net Listener process in 9i contains a remotely exploitable
    buffer overrun flaw that when successfully exploited gives an attacker
    the ability to run whatever code he chooses. The Listener monitors TCP
    port 1521 for client requests to use the 9i database. When a request
    comes in, the process passes it to the database.
    Such requests are passed in Transparent Network Substrate packets,
    which include a "service_name" parameter. If an attacker supplies an
    overly long value for this parameter when forming an error message to
    be written in the log file, the value overwrites a return address on
    the stack.
    Any code that the attacker runs on the exploited machine will run in
    the local system context by default on Windows machines, the NGSS
    alert says. And because the overrun happens before the error message
    is written to the log file, it may be difficult to detect a successful
    The second flaw is a buffer overrun vulnerability in the Report Server
    component of the 9i Application Server. If an attacker sent an overly
    long database name parameter to the rwcgi60 program using the
    "setauth" method, he could overrun the buffer and gain control of the
    process's execution.
    On Windows machines, the attacker's code would run in the local system
    context by default, the bulletin says.
    Oracle, of Redwood Shores, Calif., has released patches for the flaws,
    which are available through its Metalink service.
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.

    This archive was generated by hypermail 2b30 : Thu Jun 13 2002 - 03:38:18 PDT