CERT-In Vulnerability Note
CIVN-2003-0013
SQL Injection Vulnerability in Oracle9i Application Server
Original Issue Date:November 27, 2003
Severity Rating: HIGH
Systems Affected
- Oracle9i Application Server Portal Release 1, v 3.0.9.8.5 and earlier
- Oracle9i Application Server Portal Release 2, v 9.0.2.3.0 and earlier
Portal version 9.0.2.6 and onwards are not vulnerable.
Overview
Stored packages and procedures can be accessed using PL/SQL through Oracle's Application Server's Portal module. Many of the PL/SQL packages and procedures are vulnerable to SQL Injection. An unauthenticated user can launch a SQL Injection attack and gain unauthorized access to data in Oracle9i Application Server.
Impact
A malicious user with HTTP access can gain access to all data in the database from the Internet or corporate network. The malicious user can also execute unauthorized queries to compromise data integrity and affect database server performance.
Description
Users can access Pl/SQL packages and stored procedures in the database without being authenticated. A user with limited rights or lower rights may execute a PL/SQL procedure which is intended for a higher privilege user. The user with lower rights may thus get access to data which is not accessible to him normally. An attacker can gain access to all data within the database by exploiting this vulnerability and using SQL Injection attack.
The packages susceptible to this kind of exploit are: - List of Values LOVs
- Portal DB Provider Forms
- Portal DB Provider Hierarchy
- Portal DB Provider XML component
All of these packages are required by the database server. Hence the access to these packages cannot be disabled.
Solution
Apply the appropriate patch available at http://metalink.oracle.com .
Appropriate testing and backups should be performed before applying any patch.
Vendor Information
Oracle
Oracle Security Alert 61 Dated: November 3, 2003
http://otn.oracle.com/deploy/security/pdf/2003alert61.pdf
References
Oracle Security Alert
http://otn.oracle.com/deploy/security/pdf/2003alert61.pdf
Next Generation Security Software Ltd.
http://www.nextgenss.com/advisory.htm
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|