Argeniss Security Advisory Name: Oracle Database 10gR1 Buffer overflow in VERIFY_LOG procedure (DB03) Affected Software: Oracle Database Server version 10gR1 Severity: High Remote exploitable: Yes (Authentication to Database Server is needed) Credits: Esteban Martínez Fayó Date: 4/18/2006 Advisory Number: ARG040603 Details: Oracle Database Server provides the DBMS_SNAPSHOT_UTL package that includes capability to manage materialized views. This package contains the public procedure VERIFY_LOG that is vulnerable to buffer overflow. By default DBMS_SNAPSHOT_UTL has EXECUTE permission to PUBLIC so any Oracle database user can exploit this vulnerability. Exploitation of this vulnerability allows an attacker to execute arbitrary code. It can also be exploited to cause DoS (Denial of Service) killing Oracle server process. Vendor Status: Vendor was contacted and a Critical Patch Update was released. Workaround: Restrict access to the DBMS_SNAPSHOT_UTL package (See Links section). Patch Available: Although this security bug is addressed in the Critical Patch Update April 2006, for most of the affected platforms there are no patches available at this moment. Oracle informed that the missing patches would be available on 01-May-06 !!!! Links: http://www.argeniss.com/research/ARGENISS-ADV-040603.txt http://www.argeniss.com/research/Workaround-ADV-040603.sql http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html Spam: Searching for Oracle 0days? Argeniss Ultimate 0day Exploits Pack http://www.argeniss.com/products.html Argeniss - Information Security *Application Security Experts* http://www.argeniss.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
This archive was generated by hypermail 2.1.3 : Thu Apr 20 2006 - 20:09:24 PDT