NGSSoftware Insight Security Research Advisory Name: PLSQL Injection in Oracle Application Server Systems Affected: Oracle Application Server 9.0.4.3, 10.1.2.2, 10.1.4.1 Severity: Critical Vendor URL: http://www.oracle.com/ Author: David Litchfield [ davidl_at_ngssoftware.com ] Reported: 9th October 2007 Date of Public Advisory: 15th July 2008 Advisory number: #NISR15072008 CVE: CVE-2008-2589 Overview ******** Oracle has just released a fix for a flaw that, when exploited, allows an unauthenticated attacker on the Internet to gain full control of a backend Oracle database server via the front end web server. Details ******* Oracle Application Server installs a number of PLSQL packages in the backend database server. One of these is the WWV_RENDER_REPORT package and it is vulnerable to PLSQL injection. This package uses definer rights execution and therefore executes with the privileges of the owner, in this case the highly privileged PORTAL user. Specifically, the SHOW procedure takes as its 2nd argument the name of a function to execute and this is embedded with a dynamically executed anonymous block of PLSQL without first being sanitized. Because it is a block of anonymous PLSQL, an attacker can exploit this flaw to run any SQL statement, for example, create new users, grant dba privileges, delete or modify data. This is achieved by wrapping the statement(s) within an "execute immediate" statement and specifiying the autonomous_transaction pragma. Fix Information *************** Oracle was alerted to this flaw on the 9th October 2007. A patch has now been made available: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuj ul2008.html NGSSQuirreL for Oracle, an advanced vulnerability assessment scanner designed specifically for Oracle, can be used to accurately determine whether your servers are vulnerable to these flaws. More information about NGSSQuirreL for Oracle can be found here: http://www.ngssoftware.com/products/database-security/ngs-squirrel-oracle.ph p About NGSSoftware ***************** NGSSoftware develops vulnerability assessment and compliancy tools for database servers including Oracle, Microsoft SQL Server, DB2, Sybase and Informix. Headquartered in the United Kingdom NGS has offices in London, St. Andrews (UK), Brisbane, and Perth (Australia) and Seattle in the United States; NGSConsulting provide services to some of the largest and most demanding organizations around the globe. http://www.ngssoftware.com/ Telephone +44 208 401 0070 Fax +44 208 401 0076