what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

oracle23122004I.txt

oracle23122004I.txt
Posted Dec 31, 2004
Site ngssoftware.com

NGSSoftware Insight Security Research Advisory #NISR2122004I - Database triggers exist to help maintain data integrity and perform certain actions when a table's data is modified. Many of the default triggers in Oracle can be abused to gain elevated privileges. Systems Affected: Oracle 10g/9i on all operating systems.

tags | advisory
SHA-256 | e72c95ea02cc6dce6f0b00cfde315e1752b174373db4397eb16a6eb2becf9523

oracle23122004I.txt

Change Mirror Download

NGSSoftware Insight Security Research Advisory

Name: Oracle 10g/9i Trigger Abuse
Systems Affected: Oracle 10g/9i on all operating systems
Severity: High risk
Vendor URL: http://www.oracle.com/
Author: David Litchfield [ davidl at ngssoftware.com ]
Relates to: http://www.nextgenss.com/advisories/oracle-01.txt
Date of Public Advisory: 23rd December 2004
Advisory number: #NISR2122004I
Advisory URL: http://www.ngssoftware.com/advisories/oracle23122004I.txt

Description
***********
Database triggers exist to help maintain data integrity and perform certain
actions when a table's data is modified. Many of the default triggers in
Oracle can be abused to gain elevated privileges.

Details
*******

Triggers are written in PL/SQL and execute with the privileges of the
definer/owner.


The trigger SDO_CMT_CBK_TRIG, owned by MDSYS, fires when a DELETE is
performed on the SDO_TXN_IDX_INSERTS table also owned by MDSYS. PUBLIC has
the SELECT, INSERT, UPDATE and DELETE object privileges on this table.
Consequently, anyone can cause the SDO_CMT_CBK_TRIG trigger to fire by
deleting a row from the table. If we examine the text of the trigger we can
see that, before the DELETE actually occurs, a list of functions are
selected from the SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE tables and
then these functions are executed. PUBLIC has no object privileges set for
either of these tables so they can not insert their own funtion name.
However, the PRVT_CMT_CBK package owned by MDSYS has two procedures,
CCBKAPPLROWTRIG and EXEC_CBK_FN_DML, that take as their parameters a schema
and function name which are then inserted into the SDO_CMT_DBK_FN_TABLE and
SDO_CMT_CBK_DML_TABLE tables. PUBLIC has the EXECUTE permission on the
PRVT_CMT_CBK package and, as it has not been defined with the 'AUTHID
CURRENT_USER' keyword, the package executes using the rights of MDSYS, the
definer, and not the invoker. As a result of this anyone can indirectly
insert function names into the SDO_CMT_DBK_FN_TABLE and
SDO_CMT_CBK_DML_TABLE tables. Thus when a DELETE occurs on
SDO_TXN_IDX_INSERTS anyone can influence what actions the SDO_CMT_CBK_TRIG
trigger takes - in other words, anyone can get the trigger to execute an
arbitrary function. What is more, this function, as it is being executed
from the trigger will run with the privileges of MDSYS and an attacker can
exploit this to gain elevated privileges.



The MDSYS.SDO_GEOM_TRIG_INS1 is vulnerable to SQL injection on both 9i and
10g. The trigger executes the following

..
..
EXECUTE IMMEDIATE
'SELECT user FROM dual' into tname;
stmt := 'SELECT count(*) FROM SDO_GEOM_METADATA_TABLE ' ||
'WHERE sdo_owner = ''' || tname || ''' ' ||
' AND sdo_table_name = ''' || :n.table_name || ''' '||
' AND sdo_column_name = ''' || :n.column_name || ''' ';
..
..

when an INSERT is performed on MDSYS.USER_SDO_GEOM_METADATA. The
:new.table_name and :new.column_name can be influenced by the user and SQL
injected. PUBLIC has the permissions to INSERT into this table. As such the
trigger can be abused to gain MDSYS privileges - a DBA.



The MDSYS.SDO_LRS_TRIG_INS trigger fires when an INSERT occurs on the
MDSYS.USER_SDO_LRS_METADATA view. PUBLIC can insert into this view and so
cause the trigger to fire. This trigger is vulnerable to SQL injection. Both
Oracle 9i and 10g are affected. It executes

..
..
stmt := 'SELECT count(*) FROM SDO_LRS_METADATA_TABLE ' ||
' WHERE sdo_owner = ''' || UPPER(user_name) || ''' ' ||
' AND sdo_table_name = ''' || UPPER(:n.table_name) || ''' ' ||
' AND sdo_column_name = ''' || UPPER(:n.column_name) || ''' ';
EXECUTE IMMEDIATE stmt INTO vcount;
..
..

and :new.table_name and :new.column_name are user supplied in the insert
statement. This is where an attacker can insert SQL.






Fix Information
***************
A patch (#68) was released for this problem by Oracle. See
http://metalink.oracle.com/ for more details. NGSSQuirreL for Oracle
(http://www.nextgenss.com/squirrelora.htm), can be used to assess whether
your Oracle servers are vulnerable to this.


About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com














Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close