CERT-In Vulnerability Note CIVN-2008-110
Oracle Database Local Untrusted Library Path Vulnerability

Original Issue Date: July 29, 2008

Severity Rating: Medium

System Affected

• Oracle 11g R1 version 11.1.0.6.0 on 32-bit Linux platform

Overview

A vulnerability has been reported in a set-uid root program distributed with Oracle Database for Linux and Unix platforms, which could be exploited by the remote attackers to cause execution of arbitrary code with their elevated privileges of the root.

Description

A Local exploitation of a untrusted library path vulnerability has been reported in the Oracle Database for Linux and Unix platforms, specifically in a set-uid root program distributed with Oracle Database. By replacing a module owned by the oracle user, which is loaded by this program, an attacker can execute arbitrary code as root.

Workaround

Administrators can remove the set-uid bit from the vulnerable program to prevent the exploitation of this vulnerability. However, doing so could impair the functionality of the DBMS_SCHEDULER package.

Solution

Apply patches as mentioned in Oracle Advisory
http://www.oracle.com/technology/deploy/security/
critical-patch-updates/cpujul2008.html

Vendor Information

Oracle Corporation
http://www.oracle.com/technology/deploy/security/
critical-patch-updates/cpujul2008.html

References

iDefense Labs
http://labs.idefense.com/intelligence/vulnerabilities/display.php?
id=727

SecuriTeam
http://www.securiteam.com/unixfocus/5PP0B20OUY.html

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003