what you don't know can hurt you

Oracle Privilege Escalation / Denial Of Service / Code Execution

Oracle Privilege Escalation / Denial Of Service / Code Execution
Posted Feb 2, 2021
Authored by Harrison Neal

The Oracle CPU dated 2020 Jan 14 included patches for various issues related to database links and gateways ("Oracle Heterogeneous Services"). Two vulnerabilities in particular might lead to privilege escalation, denial of service, or code execution attacks against Oracle databases.

tags | advisory, denial of service, vulnerability, code execution
MD5 | 1fe163207ad85f89a41dc4ed17e8407f

Oracle Privilege Escalation / Denial Of Service / Code Execution

Change Mirror Download
The Oracle CPU dated 2020 Jan 14 included patches for various issues
related to database links and gateways ("Oracle Heterogeneous Services").
Two vulnerabilities in particular might lead to privilege escalation,
denial of service, or code execution attacks against Oracle databases.

Attackers might look like either:

1 ) A malicious or compromised database user with at least the CREATE
[PUBLIC] DATABASE LINK privilege; the CREATE [ANY] PROCEDURE privilege is
helpful

2 ) A malicious presence on the network with the capability to perform
man-in-the-middle attacks between an Oracle database and a linked database
gateway

Easier vulnerability - CVE-2020-2510 (SQL injection):

1 ) Choose a function to be run by a privileged database user on the
vulnerable instance, or existing privileges permitting, create a malicious
AUTHID CURRENT_USER function for this purpose

2 ) When a database gateway is queried by the vulnerable instance, ensure
that the version number returned to the vulnerable instance includes a SQL
injection attack referencing the chosen function

Harder vulnerability - CVE-2020-2517 (heap buffer overflow):

1 ) On a vulnerable instance, spray the heap with Java int[1] arrays as
much as possible (there are typically configurable memory limits on Java
heap memory in Oracle databases), and make an educated guess as to memory
addresses that these arrays may occupy

2 ) In a separate session, query a malicious database gateway, which you
should ensure will return an overly long error message that overflows a
heap buffer and overwrites address pointers with your educated guess from
the prior step

3 ) If an array's length is successfully corrupted such that its bounds
would extend into subsequent array(s), and that corrupted array is still
usable (consider encapsulating array accesses in a try-catch), modify a
subsequent array to have a length of 0x40000000

4 ) Use the modified subsequent array as a write-what-where primitive

-HN


Login or Register to add favorites

File Archive:

June 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    35 Files
  • 2
    Jun 2nd
    14 Files
  • 3
    Jun 3rd
    40 Files
  • 4
    Jun 4th
    22 Files
  • 5
    Jun 5th
    1 Files
  • 6
    Jun 6th
    1 Files
  • 7
    Jun 7th
    19 Files
  • 8
    Jun 8th
    14 Files
  • 9
    Jun 9th
    39 Files
  • 10
    Jun 10th
    20 Files
  • 11
    Jun 11th
    22 Files
  • 12
    Jun 12th
    2 Files
  • 13
    Jun 13th
    1 Files
  • 14
    Jun 14th
    32 Files
  • 15
    Jun 15th
    34 Files
  • 16
    Jun 16th
    9 Files
  • 17
    Jun 17th
    33 Files
  • 18
    Jun 18th
    11 Files
  • 19
    Jun 19th
    1 Files
  • 20
    Jun 20th
    3 Files
  • 21
    Jun 21st
    2 Files
  • 22
    Jun 22nd
    21 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close