what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

AppSecInc.oracleDBMS.txt

AppSecInc.oracleDBMS.txt
Posted May 30, 2005
Authored by Esteban Martinez Fayo | Site appsecinc.com

Multiple SQL injection vulnerabilities exist in the DBMS_METADATA package for Oracle database server versions 9i and 10g.

tags | advisory, vulnerability, sql injection
SHA-256 | 9c197b54da59422b26a68e8b4cc788a15635ca92f877520ad3c5ec7c525b0aa3

AppSecInc.oracleDBMS.txt

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Multiple SQL Injection vulnerabilities in DBMS_METADATA package

AppSecInc Team SHATTER Security Advisory
http://www.appsecinc.com/resources/alerts/oracle/2005-03.html
April 18, 2005

Affected Versions: Oracle Database Server versions 9i and 10g

Risk Level: High

Credits: This vulnerability was discovered and researched by Esteban
Martínez Fayó of Argeniss for Application Security Inc.

Details:
The OBJECT_TYPE parameter -- used in various procedures of the
DBMS_METADATA package -- is vulnerable to SQL injection. Although this
package executes with the privileges of the calling user, it internally
uses another package that executes the injected SQL with the privileges
of the SYS user thereby allowing an attacker to gain DBA privileges. By
default PUBLIC has EXECUTE privilege on DBMS_METADATA.

Impact:
Any low privileged database user can execute functions with DBA
privileges. Users with privilges to create or modify a function can
inject a user-defined function in the vulnerable procedure and thus
execute SQL statements with DBA privileges.

Workaround:
Revoke Execute privilege on the vulnerable package.

Vendor Status:
Vendor was contacted and a patch was released.

Fix:
Apply Oracle Critical Patch Update April 2005 available at
http://metalink.oracle.com

Links:
Application Security, Inc advisory:
http://www.appsecinc.com/resources/alerts/oracle/2005-03.html
Oracle security alert:
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf
Advanced SQL Injection in Oracle databases presentation:
http://www.argeniss.com/research.html


- --
_____________________________________________
Application Security, Inc.
www.appsecinc.com
AppSecInc is the leading provider of database security solutions for the
enterprise. AppSecInc products proactively secure enterprise
applications at more than 300 organizations around the world by
discovering, assessing, and protecting the database against rapidly
changing security threats. By securing data at its source, we enable
organizations to more confidently extend their business with customers,
partners and suppliers. Our security experts, combined with our strong
support team, deliver up-to-date application safeguards that minimize
risk and eliminate its impact on business.




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)

iD8DBQFCZAVr/0w1dSVRt4URAmqXAKC1XublBC2knts8TL9PSftz2oIwEgCePvz5
miyRWVoxfyHaMOryDqxfi4E=
=veNk
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close