-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SQL Injection in ALTER_MANUALLOG_CHANGE_SOURCE procedure AppSecInc Team SHATTER Security Advisory http://www.appsecinc.com/resources/alerts/oracle/2005-04.html April 18, 2005 Affected versions: Oracle Database Server version 10g Risk level: High Credits: This vulnerability was discovered and researched by Esteban Martínez Fayó of Argeniss for Application Security Inc. Details: The CHANGE_SOURCE_NAME parameter of the standard procedure SYS.DBMS_CDC_IPUBLISH.ALTER_MANUALLOG_CHANGE_SOURCE is vulnerable to SQL injection. This package executes with privileges of the SYS user; by default, PUBLIC has EXECUTE privilege. Impact: Any low privileged database user can execute functions with DBA privileges. Users with privilges to create or modify a function can inject a user-defined function in the vulnerable procedure and thus execute SQL statements with DBA privileges. Workaround: Revoke Execute privilege on the DBMS_CDC_IPUBLISH package Vendor Status: Vendor was contacted and a patch was released. Fix: Apply Oracle Critical Patch Update April 2005 available at http://metalink.oracle.com Links: Application Security, Inc advisory: http://www.appsecinc.com/resources/alerts/oracle/2005-04.html Oracle security alert: http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf Advanced SQL Injection in Oracle databases presentation: http://www.argeniss.com/research.html - -- _____________________________________________ Application Security, Inc. www.appsecinc.com AppSecInc is the leading provider of database security solutions for the enterprise. AppSecInc products proactively secure enterprise applications at more than 300 organizations around the world by discovering, assessing, and protecting the database against rapidly changing security threats. By securing data at its source, we enable organizations to more confidently extend their business with customers, partners and suppliers. Our security experts, combined with our strong support team, deliver up-to-date application safeguards that minimize risk and eliminate its impact on business. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (MingW32) iD8DBQFCZAWn/0w1dSVRt4URAsX4AJ9Smw5RP05fns/uyQlC0rfZj8bm2gCgrTmv Zqxq1NYOFfM9j6cy8cdiNeU= =1GtZ -----END PGP SIGNATURE-----
This archive was generated by hypermail 2.1.3 : Mon Apr 18 2005 - 17:48:50 PDT