Argeniss Security Advisory


Name:  Oracle Database 10gR1 Buffer overflow in
VERIFY_LOG procedure (DB03)
Affected Software:  Oracle Database Server version
10gR1
Severity:  High
Remote exploitable:  Yes (Authentication to Database
Server is needed)
Credits:  Esteban Martínez Fayó
Date:  4/18/2006
Advisory Number:  ARG040603


Details: 
Oracle Database Server provides the DBMS_SNAPSHOT_UTL
package that includes capability to manage
materialized views.
This package contains the public procedure VERIFY_LOG
that is vulnerable to buffer overflow.

By default DBMS_SNAPSHOT_UTL has EXECUTE permission to
PUBLIC so any Oracle database user can exploit this
vulnerability.
Exploitation of this vulnerability allows an attacker
to execute arbitrary code. It can also be exploited to
cause DoS (Denial of Service) killing Oracle server
process. 


Vendor Status:
Vendor was contacted and a Critical Patch Update was
released.


Workaround:
Restrict access to the DBMS_SNAPSHOT_UTL package (See
Links section).


Patch Available:
Although this security bug is addressed in the
Critical Patch Update April 2006, for most of the
affected platforms there are no patches available at
this moment.
Oracle informed that the missing patches would be
available on 01-May-06 !!!!


Links:
http://www.argeniss.com/research/ARGENISS-ADV-040603.txt
http://www.argeniss.com/research/Workaround-ADV-040603.sql
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html


Spam:
Searching for Oracle 0days? 
Argeniss Ultimate 0day Exploits Pack
http://www.argeniss.com/products.html


Argeniss - Information Security
*Application Security Experts*
http://www.argeniss.com



__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com