Vulnerability

CERT-In Vulnerability Note CIVN-2003-0012
Buffer Overflow in Oracle Database Server Binaries

Original Issue Date:October 29, 2003

Severity Rating: MEDIUM

Systems Affected

Oracle9i Release 2, Version 9.2.x.
Oracle9i Release 1, Version 9.0.x.

hosted on all supported variants of Unix/Linux.

Overview

A malicious user can cause buffer overflow by executing 'Oracle' and 'OracleO' binary files with a very long command line parameter. Some exploit code can then be run by the user resulting in compromise of the database server and the operating system hosting the database server.

Impact

This buffer overflow allows a malicious user to run the program to get 'Oracle' owner privileges, execute arbitrary code under these privileges and compromise the database server. The underlying operating system may also get compromised by the malicious user causing the buffer overflow.

Description

The binary files, Oracle and OracleO, which are owned by oracle operating system account and dba operating system group accept parameters on command line for execution. A very long parameter, if passed to these binary files, results in buffer overflow. The resulting buffer overflow allows the user to run exploit code under the privilege of Oracle owner leading to the compromise of database server.

According to the security note issued by Oracle and SHATTER Team, a user with account on the operating system hosting the database server and having permission to execute the $ORACLE_HOME/bin/oracle or $ORACLE_HOME/bin/oracleO files can only exploit this vulnerability.

Workaround

The operating system group other should be denied execute permission on these binaries. It should also be ensured that the group owning Oracle and OracleO binaries has only authenticated users in it.

Solution

Apply the appropriate patch available at http://metalink.oracle.com.
Appropriate testing and backups should be performed before applying any patch.

Vendor Information

Oracle

Oracle Security Alert 59 Dated: October 22, 2003.

http://otn.oracle.com/deploy/security/pdf/2003alert59.pdf

References

Oracle Security Alert
http://otn.oracle.com/deploy/security/pdf/2003alert59.pdf

SHATTER Team Security Alert
http://www.appsecinc.com/resources/alerts/oracle/2003-0006.html

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-2436857

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India